Construction cybersecurity in San Antonio, for most JBSA subcontractors, comes down to 4 flowed-down rules, the 15 FAR 52.204-21 safeguards, a CMMC Level 1 affirmation in SPRS before award, Section 889 camera limits, and no TikTok on job phones. All of it arrives in the prime’s subcontract. Little of it is optional.
This is written for the electrical, mechanical, roofing, and finish trades that build under a prime at Lackland, Fort Sam Houston, Randolph, and Camp Bullis. It’s the subcontract side of our construction IT services in San Antonio, and it’s narrower than most owners fear. A lot of it is paperwork. Some of it isn’t. That part usually involves a camera trailer. Or a foreman’s phone.
Read the cyber clauses in the rider before you price the job. If drawings, schedules, or RFIs from a Defense project will sit in your email, Procore, or a field tablet, FAR 52.204-21 applies to those systems. When the subcontract carries the CMMC clause, a senior official has to affirm Level 1 in SPRS before award and every year. Check every camera you’d install for Hikvision, Dahua, or Hytera hardware, and keep TikTok off any phone used on the job.
What Does Construction Cybersecurity Mean on a JBSA Subcontract?
On a JBSA subcontract, construction cybersecurity is the set of security controls, registrations, and equipment rules your subcontract makes binding, applied to every company system that stores or passes along information the government never made public. In practice that’s your email, your project platform, and the phones and tablets your field staff carry.
One defined term triggers it. Federal contract information, or FCI, is information provided by or generated for the government under a contract and not intended for public release. A drawing set the prime shares through Procore usually qualifies. Even when the bid set was public, the RFIs, submittals, and revised sheets generated after award usually aren’t. So does a 3-week lookahead. So does an RFI log. Public solicitation documents don’t, and neither does simple transactional information, which the clause describes as the kind needed to process payments.
Contractors push back here. It’s just a door hardware schedule, they say. Doesn’t matter. FAR 52.204-21 doesn’t grade sensitivity. It asks one question. Was the information meant for the public? A door schedule for a building on Lackland almost never was.
Who Holds the Prime Contracts on Bexar County Defense Construction?
Mostly firms from somewhere else. That’s exactly why this lands on local subcontractors.
We pulled every Defense Department construction obligation (NAICS 23) with a place of performance in Bexar County from USAspending for fiscal 2024 through July 17, 2026, the latest date the Defense data reached when we pulled it, then sorted the dollars by where each prime contractor is based.
| Fiscal year | Net DoD construction obligations in Bexar County | Prime recipients | Primes based in Bexar County | Dollars to Bexar-based primes | Dollars to primes outside Texas |
|---|---|---|---|---|---|
| 2024 | $505.4 million | 105 | 40 | 9.0% | 81.9% |
| 2025 | $167.8 million | 120 | 25 | 22.1% | 63.4% |
| 2026 (through July 17) | $216.0 million | 67 | 12 | 0.5% | 78.3% |
| All years to date | $889.3 million | 200 | 47 | 9.4% | 77.5% |
Read the last column first. Across the whole period, 123 of the 200 primes listed an address outside Texas, and they took 77.5% of the money. Bexar County firms took about 9 cents of each dollar. Fiscal 2024 is lopsided. One award, $238.4 million to Clark Construction Group, dominates it, and fiscal 2026 is still partial, because Defense contract data reaches USAspending on a delay and September is usually the biggest month, so don’t read too much into any one year.
2 offices place most of it. JBSA’s own 502nd Contracting Squadron, which shows up as FA3016 at the front of award IDs, accounted for 47.4% of fiscal 2025 obligations in our pull and 47.7% of fiscal 2026 so far. The Army Corps of Engineers Fort Worth District, prefix W9126G, placed another 43.3% of fiscal 2026 so far.
JBSA’s $990 million construction vehicle tells the same story. According to the Defense Department’s May 16, 2022 contract announcement, a multiple award construction contract with a $990 million ceiling went to 13 small businesses for work at Joint Base San Antonio, Laughlin, and Goodfellow, with work expected to run through May 15, 2032. Gideon Contracting is the only awardee based in San Antonio. 2 more sit in Garden Ridge and New Braunfels. The other 10 are out of state, from Alaska and Hawaii to Florida.
So a prime from Dayton or Anchorage wins the task order. Local trades build it. Then its compliance desk sends you a rider. Public data barely shows that second step, because primes reported first-tier subawards to just 3 subcontractors, worth about $0.4 million in all, under fiscal 2025 Bexar County defense construction, against $167.8 million in prime obligations.
Why Are Primes Pushing Cyber Clauses Down to the Trades Now?
2 reasons. One’s legal. One’s criminal.
On the legal side there’s DFARS 252.204-7021, the CMMC clause, which started showing up in Defense solicitations once Phase 1 began on November 10, 2025. Paragraph (d)(4) of DFARS 252.204-7021 makes the prime ensure that every subcontractor and supplier handling FCI or CUI completes its affirmation before the subcontract is awarded and keeps it current each year. A prime that skips your affirmation inherits the problem. It won’t skip it.
Then there’s ransomware. GuidePoint Security’s research team counted 131 construction victims on extortion sites in the first quarter of 2026, up 44% from a year earlier, which made construction the 4th most hit industry in its Q1 2026 report. It slipped to 7th in the Q2 2026 report. Still top 10. Primes know their subs hold the same drawings they do. So do attackers. Houston pressure comes from a different direction, owners screening general contractors before price is compared, which we cover in construction cybersecurity for Houston general contractors.
Which Cyber Clauses Flow Down to a Construction Subcontractor?
6 clause families do almost all the work. Here’s where each one lands, under the old number and the new one.
| Clause | What it asks of a subcontractor | When it reaches your subcontract | Where it bites on a construction job |
|---|---|---|---|
| FAR 52.204-21, now 52.240-93 in newer DoD contracts | 15 basic safeguarding requirements on every system holding FCI | When FCI may reside in or move through your systems | Email, Procore or Autodesk accounts, the plan-room PC, field tablets |
| DFARS 252.204-7021 | A current CMMC status and an annual affirmation in SPRS | When the subcontract involves FCI or CUI | The owner’s SPRS login and signature, before award |
| FAR 52.204-25, now part of 52.240-91 | No covered Huawei, ZTE, Hikvision, Dahua, or Hytera equipment provided, or used in performance under the new clause, and a prompt report if any turns up | Every subcontract, commercial ones included | Camera trailers, CCTV and access control installs, radios, network gear |
| FAR 52.204-27, now part of 52.240-91 | No TikTok on any IT used or provided under the contract | Every subcontract, commercial ones included | Company phones and the personal phones crews use for job photos |
| DFARS 252.240-7994 | No drones, drone parts, or drone software from China, Russia, Iran, or North Korea, and no DJI equipment | Every subcontract under the 2026 DoD deviation | Survey, mapping, and progress-photo drones |
| DFARS 252.204-7012, with 7019 and 7020 or their replacement 252.240-7997 | NIST SP 800-171, incident reports within 72 hours, and access for any government assessment | When your work involves covered defense information | Whatever system holds CUI-marked drawings or specifications |
Why 2 numbers? Since early 2026 the Defense Department has used the rewritten FAR Part 40 from the Revolutionary FAR Overhaul, under Class Deviation 2026-O0025, in place of the codified text. Newer contracts carry 52.240-93 and 52.240-91. The 15 safeguards in 52.240-93 are word for word the old ones. Section 889, the TikTok ban, and the Kaspersky ban now sit together in 52.240-91. Contracts awarded earlier keep the old numbers until they’re modified, so match your rider to whichever set it cites.
Notice what isn’t on the list. No clause makes a trade contractor buy a specific product, hire a security officer, or pass a third-party audit at Level 1. Most of the work is configuration, records, and one signature.
What Has to Be in SPRS Before the Subcontract Is Signed?
2 things. A current CMMC Level 1 self-assessment and an affirmation from a senior official, both entered before award. 32 CFR Part 170 says it plainly in section 170.15(b). Prior to award of any contract or subcontract with a Level 1 requirement, the company must hold that status and have an affirmation in SPRS for every system in scope.
Level 1 has no partial credit. Plans of action aren’t allowed, so every requirement has to score MET. The self-assessment repeats every year, and the evidence behind it has to be kept for 6 years from the status date. That last rule matters on a construction job, because the superintendent who set up the trailer laptop may be 3 projects gone by the time anyone asks.
Here’s the sequence. Start it before you bid, not after the award notice.
- Confirm your SAM.gov registration and CAGE code, since the SPRS entry lists every CAGE code the assessment covers. Plenty of trades that have only ever worked as subs have never registered.
- Get a PIEE account with SPRS access for whoever will enter the results.
- Draw the scope. List each system that will hold or pass FCI, usually Microsoft 365, the project platform, the plan-room PC, and every phone or tablet in the field.
- Assess all 15 requirements using the NIST SP 800-171A objectives for the 17 NIST requirements they map to, and close every gap before you go further.
- Enter the level, status date, scope, CAGE codes, and result in SPRS.
- Have your affirming official sign the affirmation in SPRS.
- Send the prime the confirmation its compliance team asks for, then put next year’s date on the calendar.
Who signs matters. The rule defines the affirming official as the senior level representative responsible for compliance, with authority to affirm it for the whole company. In a construction company that’s usually the owner, the president, or the CFO. It isn’t the office manager who happens to know the password, and we tell owners not to hand it off, because the person who signs is making a statement to the federal government under their own name. Treat it that way.
How Do the 15 Safeguards Translate to a Jobsite?
FAR wording assumes an office. Trailers are harder. This is how we map the 15 requirements to what we actually see fail on construction work. The middle column is our standard setup, and in places it goes further than the clause does, with multifactor sign-in as the main example.
| FAR 52.204-21 requirement | How we meet it | The jobsite version that fails |
|---|---|---|
| (i) and (ii) Limit access to authorized users and permitted functions | Named accounts for everyone, with admin rights kept to the few who need them | A shared superintendent login on the trailer PC |
| (iii) Control connections to external systems | Rules for personal devices and for outside portals that hold project files | Drawings saved to a personal phone and a personal cloud account |
| (iv) Control what’s posted publicly | Nothing from the job goes on social media or a public website without review | Progress photos on the company page with base buildings in frame |
| (v) and (vi) Identify and authenticate users and devices | Multifactor sign-in on email and the project platform, device inventory | Project directory accounts that stay active long after the job closes |
| (vii) Sanitize media before disposal or reuse | Wipe drives, tablets, and USB sticks before they change hands | Last job’s field tablet passed to a new hire with the drawings still on it |
| (viii) and (ix) Limit physical access, escort visitors, keep access logs | Locked trailers and offices, a visitor log, control of keys and badges | A trailer left open with a signed-in laptop on the plan table |
| (x) and (xi) Protect boundaries and separate public-facing components | A firewall at each site and a guest network kept apart from company devices | One Wi-Fi network shared by crews, inspectors, and the project engineer’s laptop |
| (xii) to (xv) Fix flaws, block malicious code, update it, scan files | Patching and endpoint protection on every device, scanning of downloaded files | A plan-room PC nobody has updated since the last job closed |
Trailers break 3 of these at once, usually shared logins, open Wi-Fi, and a door left open. That’s why we set up a trailer as its own small office, with its own firewall, a locked network closet, and no shared logins. For the wider list of what goes wrong in the field, see our look at IT risks on Texas construction job sites.
Why Do Cameras, Drones, and Crew Phones Catch Contractors Off Guard?
Because nobody thinks of them as IT. The clauses do.
Start with cameras. FAR 52.204-25 implements Section 889 of the 2019 defense authorization act. It covers telecommunications equipment produced by Huawei or ZTE, and video surveillance and telecommunications equipment produced by Hytera, Hikvision, or Dahua when it’s used for public safety, security of government facilities, or surveillance of critical infrastructure. A camera system you install on a military base for building security fits that description, in our reading.
Your copy is narrower than the prime’s. Under the old clause it leaves out paragraph (b)(2), the rule that stops a prime from using covered equipment anywhere in its business, so your duty is to keep covered equipment out of what you provide under the contract and to report any you find within 1 business day, then follow up within 10 business days. Under 52.240-91 the reach changes. The prohibition covers equipment provided to the government or used in performance of the contract, and the report becomes a single written one to the contracting office within 72 hours. That settles the camera trailer question for newer contracts. A trailer watching a base jobsite is used in performance. We keep that hardware off base under either version.
- Ask your supplier who manufactured each camera, recorder, and access panel. The clause names producers, and the logo on the box isn’t always the producer.
- Check radios too. Hytera makes them.
- Check the cellular modems and network gear in trailer kits for Huawei or ZTE hardware.
- Put the supplier’s answers in the job file, since they’re your record of a reasonable inquiry.
Drones are the newest one. DFARS 252.240-7994, dated September 2026 in the DoD deviation, bars a contractor from providing or using a drone, or its flight controller, radios, cameras, gimbals, ground control software, or data storage, from China, Russia, Iran, or North Korea. It flows to every subcontract. Check your fleet. Read literally, paragraph (b)(3) goes further and bars being an entity that operates DJI equipment at all, as determined by the Secretary of Defense. If your survey or progress-photo drone is a DJI, keep it off base work and ask the prime, in writing, how it reads that paragraph.
Phones are the other surprise. FAR 52.204-27, carried word for word into 52.240-91, bars TikTok from any information technology used or provided under the contract, and the clause goes on to say “including equipment provided by the Contractor’s employees.” Read that twice. It can reach the foreman’s personal phone.
Our reading, and it’s the cautious one, is that a phone used to take progress photos, open drawings, or answer the prime’s email is IT used under the contract. The clause borrows a federal definition of IT that has its own limits, so a prime’s lawyer may read it more narrowly, but we’d rather you never have to argue the point. A work profile doesn’t change that, because the app is still on the device. Our fix is simple. Issue company phones to anyone who touches project data, and check every phone before mobilization. Exceptions exist. They come only in writing, from the contracting officer.
When Does a Subcontract Pull In CUI and NIST SP 800-171?
When the information you’ll handle is controlled unclassified information, the government’s term for sensitive but unclassified data. Drawings for secure or mission facilities can carry CUI markings. Routine renovation and maintenance orders usually don’t.
Don’t guess. Under paragraph (m)(1) of DFARS 252.204-7012, it’s the prime’s job to decide whether information keeps its covered defense information status when it’s passed down, and to consult the contracting officer if it isn’t sure. Ask the prime in writing whether any document you’ll receive is marked CUI. Keep the answer.
If the answer is yes? The bar goes up fast. Section 170.23 of the CMMC rule makes Level 2 the minimum for any sub that handles CUI, and a sub inherits third-party assessment if the prime’s contract requires it. Your systems then have to meet the 110 requirements of NIST SP 800-171 Revision 2, a Level 2 assessment has to be current in SPRS, the government can come assess you under DFARS 252.240-7997, which replaced 7019 and 7020 in contracts written under the 2026 deviation, and any cyber incident that affects those systems or the CUI on them has to be reported to the Defense Department within 72 hours of discovery. Reporting requires a DoD-approved medium assurance certificate, so get one before the first incident, not during it. If CUI will sit in Procore or another cloud platform, the clause also requires that provider to meet the FedRAMP Moderate baseline or its equivalent, so ask the vendor before you upload anything marked. Then you hand the prime the incident number DoD assigns.
Most San Antonio trade subs don’t want CUI on their main network at all. Nor should they. Usually the answer is a small, separate environment for the CUI work only, and we’ve laid out how to draw that boundary in our guide to scoping CMMC for San Antonio contractors. How we run assessments and remediation is on our page for CMMC compliance in San Antonio.
Is CMMC Still Required After the Phase 2 Suspension?
Level 1 is, wherever the contract calls for it. On July 13, 2026 the Defense Department, which now also goes by the Department of War, suspended CMMC Phase 2, the stage that would have required third-party assessments as a condition of award starting in November 2026. In September a class deviation made that pause binding on contracting officers, as Washington Technology reported.
What didn’t pause covers nearly everything in this article. The Level 1 self-assessment, the SPRS affirmation, FAR 52.204-21, Section 889, the TikTok clause, and DFARS 252.204-7012 all still apply. The reform task force’s report hadn’t been made public when we wrote this in October 2026. A subcontractor that stopped work because it heard CMMC was paused has a missing affirmation, not a reprieve. Our CMMC timeline for Texas contractors tracks the dates as they move.
What Does It Cost to Get a San Antonio Subcontractor Ready?
Construction cybersecurity in San Antonio costs less than most owners expect, if you scope it right. Scope drives the price. Only the people and devices that touch FCI are in scope, which on a 60-person electrical contractor is often the office, the project managers, and the field leads, not every electrician on the crew. That keeps the bill small.
Our fully managed plan in San Antonio is $138 per user per month and covers the help desk, patching, and endpoint protection, and keeps the device and patch records an affirmation rests on. Contractors with their own IT person can go co-managed at $100 per user per month. Our MSSP Security Focus tier, $40 per user per month, adds firewall management, SIEM and SOC monitoring, vulnerability scanning, and incident response for companies that already have support covered. More on that tier is on our page for managed security services in San Antonio, and every rate is published on our pricing page. For the per-seat math across a whole construction company, see our breakdown of what construction IT costs in Texas. If you’re comparing providers, our ranking of IT providers for San Antonio construction companies scores federal depth as its own factor. For the rules each other type of contract adds, from Texas public owners to federal civilian work, see our guide to IT compliance for Texas contractors.
Questions San Antonio Subcontractors Ask About JBSA Cyber Clauses
Do I need CMMC to work as a subcontractor at Joint Base San Antonio?
You need CMMC Level 1 if your subcontract includes the CMMC clause and you’ll handle Federal contract information, which most trades receiving drawings or schedules do. It’s a self-assessment and an annual affirmation in SPRS, with no outside auditor at Level 1.
Are construction drawings for a base project Federal contract information?
Usually, yes. Drawings, schedules, RFIs, and submittals generated for the government under a contract count as FCI unless they were released to the public, as solicitation documents on SAM.gov are. The FAR definition has no sensitivity threshold, so a plain door schedule qualifies.
Can we sign the subcontract now and finish the SPRS affirmation later?
No, not when the subcontract carries a CMMC Level 1 requirement. 32 CFR 170.15(b) requires the status and the affirmation in SPRS before award, and DFARS 252.204-7021 makes the prime confirm it, so a late affirmation can cost you the award.
Does the TikTok ban really cover my crew’s personal phones?
It can. FAR 52.204-27 covers IT used under the contract “including equipment provided by the Contractor’s employees,” and we treat a personal phone used for job photos, drawings, or project email as in scope. Giving company phones to anyone who handles project data is the simplest fix.
Can we keep using our jobsite camera trailers on a base project?
Yes, as long as no part of the system was produced by Hikvision, Dahua, Hytera, Huawei, or ZTE. Newer DoD contracts use FAR 52.240-91, which covers equipment used in performance, so a trailer on a base jobsite is plainly in scope. Ask your supplier who made the cameras, recorder, and modem, keep the answer in the job file, and report anything covered right away.
Who should sign the SPRS affirmation at a construction company?
A senior official with authority over the whole company, usually the owner, president, or CFO. The CMMC rule defines the affirming official as the senior representative responsible for compliance, and that person repeats the affirmation every year.
Bidding JBSA work this year? We’ll scope which of your systems touch Federal contract information, close the 15 safeguards, check your cameras and phones, and get your affirming official ready to sign in SPRS before the prime asks.
Check My JBSA ReadinessNeed more than a subcontract checklist? Our cybersecurity services in San Antonio cover monitoring and incident response year round, and the plan options for the rest of the business are on our page for managed IT services in San Antonio.
