Engineering Firm Cybersecurity in San Antonio: What Client Contracts and Federal Work Now Require

I’m Uprite’s CTO, and this is the compliance half of IT services for engineering firms. Most of what gets sold to engineers as security is a tool list. Firewalls. Endpoint agents. A training video. None of that tells you what a contract you’ve already signed obliges you to do. That’s backwards. So this post starts from the paperwork. Which client, which clause, which files.

What Does Cybersecurity Mean for an Engineering Firm?

Cybersecurity for an engineering firm is the set of controls that protect the drawings, models, calculations, sealed documents, bid files, and client data the firm creates or receives, sized to the obligations in each client contract and to the Texas rules that govern professional engineers and every business holding personal data.

Notice what’s in that list. Not credit cards. Not patient records. The valuable thing in an engineering office is the drawing set.

A hangar’s structural model. A utility’s substation layout. Your bid number, due Thursday. Those files are what clients worry about losing, and they’re what their contracts now try to control.

How Much Federal Engineering Work Lands in San Antonio Firms?

Enough to matter. And the security clauses reach firms that have barely billed a dollar yet. We pulled federal prime contract data from the USAspending.gov API for fiscal 2025, October 2024 through September 2025, for architectural, engineering, and surveying codes (NAICS 541310, 541330, and 541370), limited to recipients with a Bexar County address.

Federal agencies obligated a net $257.2 million to Bexar County recipients under those codes. 45 had positive totals, and 15 of them show exactly $500, which looks like the minimum guarantee on a multiple-award contract. That’s a contract seat, not a project. Still, it counts. But the base contract usually carries the same security clauses its task orders will. Among the 30 recipients with real obligations, the median took about $2.2 million. That’s real money.

Source is USAspending.gov, contract award types A through D, recipient location Bexar County, pulled October 2026. The Department of Defense as a whole accounted for $216.8 million, or 84.3%.

One caveat. Federal buyers use code 541330 for systems engineering too. Southwest Research Institute and 3 STS entities took 64% of the total, so this isn’t all civil and structural design. The rest of the list still includes national design firms with San Antonio offices and smaller local shops. And the Air Force, which runs the Air Force Civil Engineer Center out of Joint Base San Antonio-Lackland, is the biggest buyer overall. By a wide margin.

The local base is growing. The BLS Quarterly Census of Employment and Wages counts 437 private engineering services establishments in Bexar County in 2025, up from 370 in 2019, with employment up from 7,724 to 10,286. That’s about 23.5 people per office. Architecture adds 148 more offices, averaging under 10 people each.

Small offices, federal money, and controlled drawings. That’s the combination the contract clauses were written for.

Which Requirements Come With Which Client?

Each client adds a layer. This is the map we’d use with any San Antonio engineering firm.

Every Texas engineering firm sits in the last 2 rows. Most sit in 3 or 4. A 20-person civil firm can hold an Air Force task order, a TxDOT work authorization, and a developer’s MSA in the same month, each with different rules for the same file server.

This is our reading of the clauses, not legal advice, so have your contracts attorney confirm what your own agreements require. General contractors face a different mix, covered in our guide to IT compliance for Texas contractors.

What Do FAR 52.204-21 and Its New Number Require?

FAR 52.204-21 requires 15 basic security controls on any contractor system that processes, stores, or transmits Federal contract information, meaning nonpublic information provided by or generated for the government under a contract.

Watch the number. Under the Revolutionary FAR Overhaul, the FAR Part 40 deviation text moves this requirement to section 40.303 and clause 52.240-93, and the old 52.204-21 slot reads “Reserved.” The 15 controls didn’t change. Older contracts say 52.204-21. Newer solicitations from agencies adopting the deviation may say 52.240-93. Same obligation. Only the label moved.

In plain terms, the 15 controls in FAR 52.204-21 come down to this list.

• Only authorized people and devices get onto your systems, and only to do their own jobs
• Every user is identified and authenticated before access
• Connections to outside systems, including personal laptops, are checked and limited
• Nothing government-related gets posted to public sites without review
• Old drives and devices are wiped or destroyed before disposal or reuse
• The office and server room are locked, visitors are escorted, and physical access is logged
• The network edge is monitored and public-facing systems sit on their own subnet
• Flaws get patched promptly, and malware protection stays current and scans downloads in real time

The clause also flows down. Any subcontract where the sub may have Federal contract information on its systems has to carry it. Your surveyor. Your geotech. Your MEP subconsultant. If they touch the task order files, they owe the same 15.

When Does an Engineering Firm Need NIST SP 800-171?

An engineering firm needs NIST SP 800-171 when a DoD contract carries DFARS 252.204-7012 and the firm’s systems hold covered defense information. For design firms, that usually means controlled technical information. Drawings, in other words.

The DFARS 252.204-7012 clause defines controlled technical information as technical information with military or space application that is subject to controls on access, use, reproduction, or release, and says it would meet the criteria for distribution statements B through F. Look at the title block on a set of military construction drawings. If it carries one of those distribution statements, you’re holding it. Most firms never check.

Three things follow. Your systems need the 110 requirements in NIST SP 800-171, and DoD still assesses against Revision 2 even though NIST has published Revision 3. You have to report a cyber incident to DoD within 72 hours of discovering it. And any cloud service storing that data has to meet FedRAMP Moderate equivalency, which rules out a lot of standard file-sharing setups. Including some popular ones.

Then there’s CMMC, and its status changed twice this year. In July 2026 DoD paused Phase 2, the step that would have required third-party certification assessments, and a September 2026 DFARS class deviation made that pause binding on contracting officers. What didn’t pause is Phase 1. If a solicitation names a CMMC level, you still post a self-assessment score in SPRS and a senior official still signs an annual affirmation, under the CMMC program rule in 32 CFR Part 170.

My honest take? CMMC is one clause. Too many engineering firms have been told CMMC is the whole story. It isn’t. A firm doing only civil work for the city and TxDOT may never see a CMMC clause and still owe real security terms. If you do hold DoD drawings, our guide to what’s in scope for CMMC shows how to keep the boundary to a few workstations, and our team handles CMMC compliance in San Antonio end to end.

What Do TxDOT and Other Texas Public Clients Put in the Contract?

More than most firms remember. When it’s attached to your contract, TxDOT’s information resources and security attachment, revised May 28, 2026, binds you and your subcontractors. 5 of its terms land directly on an engineering firm’s IT.

• Any data you download from a TxDOT system is Confidential unless TxDOT says otherwise in writing
• Sensitive, Confidential, and Regulated TxDOT data has to be encrypted in transit and at rest
• A potential incident or breach involving TxDOT data gets reported immediately through TxDOT’s incident page
• TxDOT can require a security questionnaire before award, at renewal, and on a recurring basis
• Everyone who accesses a TxDOT system completes approved cybersecurity training during the contract and any renewal

That last one comes from state law, and the citation has moved. TxDOT’s attachment still points to Government Code 2054.5192. In 2025, HB 150 moved the requirement to Texas Government Code 2063.104, which says a state agency “shall require any contractor who has access to a state computer system or database” to complete certified training. It defines contractor to include subcontractors, officers, and employees. Agencies report completion by August 31 every year to the Texas Cyber Command, which the same chapter gives a facility here in San Antonio.

So track it per person. When a new drafter gets access to a TxDOT system in March, their certificate needs to exist before the agency’s August 31 report.

Energy work is different again. Under 18 CFR 388.113, critical energy infrastructure information includes “specific engineering, vulnerability, or detailed design information” about critical infrastructure. Consultants who receive it from FERC sign a nondisclosure agreement first. If you design pipeline or LNG facilities that FERC regulates, expect your client to pass that restriction down in its own NDA.

The Rule Most Firms Forget Is the One About the Seal

Here’s the requirement that applies to every licensed engineer in Texas, federal work or not. 22 Texas Administrative Code 137.33, subsection (d), says license holders “shall take reasonable steps to ensure the security of their physical or electronic seals and electronic signatures.” For electronic ones, the engineer “must have reasonable security measures in place to protect these files.”

Lose one? The clock starts. The engineer has to notify the Texas Board of Professional Engineers and Land Surveyors in writing, as soon as possible, but within 30 days of discovery. Subsection (l) adds that final work sent electronically needs “reasonable security measures to make the documents unalterable.”

Now picture where seal images tend to live. Inside a shared template. On a network drive every drafter can read. In a folder called Stamps. If anyone with template access can place your seal on a sheet, that’s hard to call a reasonable security measure.

The fix isn’t expensive. Keep the seal image and signing certificate in a location only the license holder can reach, protected by multifactor sign-in. Use the electronic seal and signature method that section 137.35 allows, applied through a certificate-based digital signature that shows any tampering, since that’s the most practical way to meet the unalterable standard in 137.33(l). Log who signed what. And if a laptop holding a seal file is stolen, the safe reading of the rule is to treat it as a seal loss and send the board written notice.

The same rule gives you a free data control. Preliminary documents released for review have to carry a legend stating their purpose, the engineer of record and license number, and the release date. Use it consistently and a leaked interim set is clearly marked as not for construction or bidding.

How Do You Protect Project Drawings and Bid Data Day to Day?

Start where the files are, then close the gaps between them. We work in this order.

1. Inventory every place drawings and models live, including the CAD server, SharePoint, project collaboration platforms, Bluebeam sessions, and email attachments
2. Turn on multifactor sign-in for every account that can reach those places, including remote access and the accounts your subconsultants use
3. Replace email attachments with expiring, logged share links for anything sent outside the firm
4. Put federal controlled drawings in a separate, restricted project area so the NIST boundary stays small
5. Keep backups that ransomware can’t change or delete, and test a full restore of an active project
6. Remove access the same day someone leaves, and review subconsultant accounts at every project closeout
7. Lock bid folders to the people pricing the job until the bid is submitted

Bid data is different. A leaked number doesn’t trigger any notice law, but it can cost you the job, and an owner who learns your files were exposed mid-procurement may have to ask hard questions about the whole submission. Where drawings and bid files should physically live is its own decision, covered in our guide to CAD file storage for San Antonio engineering firms.

What Does Texas Breach Law Cover, and What Doesn’t It?

Texas breach law covers personal information, not drawings. Under Texas Business and Commerce Code chapter 521, every business has to keep reasonable procedures protecting sensitive personal information, notify affected people within 60 days of determining a breach occurred, and notify the Attorney General within 30 days when 250 or more Texans are affected.

We checked the Texas Attorney General’s public breach list. Of the 662 notices posted when we pulled it in October 2026, covering filings back to April 2025, just 2 came from Texas firms with engineering in their names, one in Tyler and one in Frisco. The list only shows breaches touching 250 or more Texans, so smaller incidents never appear. Each affected a little over 400 Texans. Both involved names and Social Security numbers.

That’s the point. Drawings aren’t covered. Those notices were about people data, not project files. A stolen drawing set triggers nothing under chapter 521. Your exposure there runs through the contract, the client relationship, and the board’s seal rule. Either way, a written data breach response plan for Texas keeps the 60-day and contract clocks from catching you flat.

There’s also a carrot. A 2025 state law, now Business and Commerce Code chapter 542, limits exemplary damages after a breach for businesses with fewer than 250 employees that keep a cybersecurity program conforming to a recognized framework. It scales with size. Under 20 employees, it includes password policies and staff training. From 20 to 99, it includes CIS Controls Implementation Group 1. At about 23 people per office, a typical Bexar engineering office lands in that middle tier. The law counts the whole company’s headcount, though, so a branch of a national firm with 250 or more employees isn’t covered.

What Does Engineering Firm Cybersecurity Cost in San Antonio?

It depends on your rows. There are 2 broad cases. A firm with FAR obligations and a TxDOT attachment needs good identity controls, encryption, backups, monitoring, and records showing it all works. A firm holding DoD drawings needs a documented NIST SP 800-171 environment on top, with a system security plan and a score it can defend. That’s the bigger lift.

For reference, Uprite’s Fully Managed IT in San Antonio starts at $138 per user per month with on-site support, so a 20-person firm starts around $2,760 a month. Firms that keep their own IT person can add MSSP Security Focus from $40 per user per month for monitoring and response. Our breakdown of what IT security management services include shows what sits inside that number. For the whole IT budget rather than security alone, see what IT costs an engineering firm in San Antonio. Every plan carries a 120-day satisfaction guarantee. Our breakdown of cybersecurity cost in San Antonio has the full market ranges, and if a client questionnaire is asking about insurance, see what cyber insurance applications actually ask.

What San Antonio Engineering Principals Ask Us

Does FAR 52.204-21 apply to a small engineering subconsultant?

Are engineering drawings for military projects considered CUI?

Do we need CMMC certification to bid Air Force design work at JBSA right now?

What should an engineer do if a laptop with their electronic seal is stolen?

Is a breach of project files reportable under Texas law?

Can we store federal project files in regular Microsoft 365?

Want the broader picture first? See our cybersecurity services in San Antonio, or start with managed IT services in San Antonio if you’re replacing a provider outright.