Procurement for IT consulting usually ends with a price and a scope. Neither describes what actually changes on the first day of work: somebody who does not work for you now holds a login, and possibly a badge, a network profile, an administrative console and a copy of your data.
Buying through a cooperative contract transfers no security obligation to anyone. Contract 230601 settles how an eligible member may purchase and on what commercial terms. What a consultant may reach, who approved it, and how it ends are decisions only your organization can make, record and take back. This page is about making them before anyone starts, and about which document each one belongs in.
Define What the Consultant Will Be Allowed to Access
Begin with an inventory rather than a permission level. List every system in play: servers, networks, cloud platforms, databases, the content management system, backups, administrative consoles, identity providers, source code, security tooling and the buildings themselves.
Then decide, in writing and per system:
- which of them the consultant may reach, and which are explicitly out of scope
- remote, onsite or both, and from which networks
- whether any administrative privilege is needed at all, and who approves it
- accounts created for this engagement, separate from anything existing, carrying an expiry date set the day they are created
- multi-factor authentication wherever an account can change something
- what is logged, and who reads it
- how credentials reach the consultant, and how they are withdrawn
Least privilege belongs here as sound practice, not as an obligation the contract imposes on your behalf. The expiry date is the cheapest item on the list, because it is the only one that does not depend on somebody remembering.
Establish Clear Data-Handling Requirements
Identify what the work touches before describing how it must be treated. Say which classes of data are in scope, whether copies or exports may be made at all and to where, what must be encrypted in transit and at rest, who on the consultant's side may read it, how long anything may be kept after the work ends, and whether it is returned or destroyed at closeout with confirmation in writing.
One caution about the contract itself. Its confidentiality and public information provisions concern the vendor's own materials and how they are handled under public records law. They are not a protection standard for your records, and treating them as one leaves the question unanswered.
Separate the TIPS Contract From the Project-Specific Security Agreement
Contract 230601 is the purchasing vehicle. It establishes that a competitive process took place and on what terms an eligible member may buy. It was not written with your systems in front of it. If that distinction is unfamiliar, how cooperative purchasing works covers the model.
Everything particular to the engagement belongs in the documents your organization issues: the purchase order, the scope or statement of work, or a supplemental agreement with the vendor. Decide which of those carries which term, and decide it early.
- security controls and the access record
- confidentiality of your data, as distinct from the vendor's
- support obligations after delivery
- incident notification
- data ownership
- milestones and acceptance criteria
- change management
- insurance beyond the contract minimums
- termination
A requirement that lives only in an email is a requirement nobody has to meet. This is the whole of the page in one sentence, and it is the part most often deferred until work has started, by which time the leverage to agree it has gone.
Evaluate Subcontractor and Third-Party Risk
Work rarely arrives from a single organization. Implementation partners, resellers, hosting providers, cloud platforms and software vendors may all touch the engagement, and some will never be called subcontractors. The question is whether the terms you have just written follow them.
- do the access, data-handling and notification terms flow down unchanged
- who supervises that work, and whom you contact when something is wrong
- is prior approval required before a new third party joins partway through
Review Supply-Chain and Technology Restrictions
Where federal money is involved, restrictions can attach to the equipment and services themselves rather than to the purchasing process. The TIPS 230601 solicitation includes the federal provision on covered telecommunications at 2 CFR 200.216.
In outline, it prohibits using federal award funds to procure or obtain certain telecommunications and video surveillance equipment and services produced by named entities and their subsidiaries and affiliates. It is worth reading rather than paraphrasing, because the list is specific and the restriction is narrower than it is often described: the text of 2 CFR 200.216 is published at govinfo.gov.
Where it applies, the review reaches network hardware, telecommunications equipment, video surveillance, remote management tooling, cloud providers, software dependencies, and technology embedded in equipment bought for some other purpose.
Verify Insurance and Risk Transfer
Contract 230601 states minimum coverages:
- General liability: $1,000,000 each occurrence and aggregate
- Automobile liability: $300,000
- Workers' compensation: statutory applicable limits
- Umbrella liability: $1,000,000 each occurrence and aggregate
Those are floors set for the contract, not a judgment about your project. Note what is absent: the contract documentation reviewed here does not establish a universal cyber liability requirement. For an engagement that reaches regulated records or production systems, an organization may reasonably decide that technology errors and omissions or cyber coverage is appropriate, and scoping is when that can still be made a condition of the order.
Define Security Responsibilities Before Work Begins
Most security problems on a project are not breaches. They are gaps where each side assumed the other had it covered.
The customer side usually carries: approving access, identifying which systems hold sensitive data, creating and removing accounts, supplying the policies the consultant is expected to work within, and approving changes to systems of record.
The consultant side usually carries: protecting the credentials issued, working inside the access granted, documenting the changes made, protecting project information, reporting incidents, and returning or destroying information at the end.
Put both lists in the same document and have somebody sign it. A list with only one column is nearly always the customer's.
Establish an Incident-Reporting Process
Agree what counts and who is called before anything happens, because the alternative is deciding it during the event.
- what both parties will treat as reportable, which is broader than a confirmed breach
- a named contact on each side, and an alternate
- the route: a call, then something in writing
- what the first report has to contain
- preserving logs and evidence rather than tidying first
- who coordinates the investigation, and who may isolate a system
- how access resumes afterwards, and who authorizes it
Be plain about one thing: the contract documentation reviewed here sets no universal cyber incident notification timeframe for every consulting project. If you need one, it is a term you write, with a number in it. Your organization's own response plan is a larger and separate subject, and building a security program in stages covers it.
Consider K-12 Site and Personnel Requirements
A campus adds requirements that have nothing to do with technology: visitor procedures, identification and badging, areas that are restricted while students are present, and hours when work is and is not welcome. Settle them before the first visit.
Criminal-history and screening requirements are the other half, covered in what districts require of contractors working on campus. Requirements differ by state, so treat anything written about one state as an example rather than a rule that travels.
Identify Federal-Funding Requirements Early
LABUSA's contract response indicates willingness to accept purchases paid with federal funds and includes certifications to applicable federal provisions in the solicitation. Whether any given provision reaches your project depends on the funding source.
Where it does, funding can affect the procurement documentation, records and audit access, obligations passed to subcontractors, the supply-chain restrictions above, contract terms you would not otherwise include, and the grounds for termination. Identified at scoping this is administrative. Discovered at closeout it is expensive. Districts carry an additional layer of program timing, described in how a district's approvals and calendar shape a purchase.
Preserve Project Documentation and Auditability
Keep the record of the security decisions themselves, not only the purchase file: who approved which access and when, which accounts were opened and when they were closed, any exception granted and the reason for it, what was accepted, and what was returned or destroyed at the end. The purchasing paperwork around it is covered in where the ordering documents are issued.
The TIPS agreement carries its own sales and contract documentation obligations, and your organization and funding source will have theirs. Note what does not follow from that: there is no universal three-year TIPS retention rule reaching every technical log a project produces.
Treat Contract Risk as Part of Cybersecurity Risk
Indemnification, dispute resolution, termination rights and governing law decide what happens after something has gone wrong, which makes them part of the same subject as the controls meant to prevent it. Contract 230601 contains specific limitations and rules concerning member indemnity and arbitration. Read them before signature rather than after an incident. This is general information rather than legal advice, and those clauses are written for your counsel.
Security and Risk Checklist for TIPS IT Consulting
Each item is something decided and recorded before the engagement starts.
- Every system the consultant may reach is listed, and so are the ones out of scope.
- Permissions are the minimum the work needs, and administrative privilege is approved separately.
- Accounts are specific to this engagement and carry an expiry date set at creation.
- Multi-factor authentication applies wherever an account can change something.
- Subcontractors and third-party platforms are identified, and the same terms follow them.
- Data classes, copying, encryption, retention and destruction are written down.
- Incident reporting names a person, a route, and what a first report must contain.
- Insurance certificates are on file, and the limits have been read rather than assumed.
- Site and personnel requirements are settled wherever work happens on a campus.
- The funding source is known, and any federal provisions it triggers are identified.
- Removal of access at closeout has an owner and a date.
LABUSA and TIPS Contract 230601
LABUSA is an awarded vendor under TIPS Contract 230601 for consulting and other related services. For applicable federally funded purchases, LABUSA certified to the federal provisions included in the TIPS solicitation, including the covered telecommunications provision described above. LABUSA holds ISO 9001:2015 and ISO/IEC 27001:2022 registrations, and the discipline that applies to any supplier applies here too: read a certificate for its scope rather than its headline. What the award covers is set out on the contract this work would be bought under.
Once a requirement is clear enough to describe, its security terms can be drafted alongside the scope instead of after it. LABUSA can help define the technical scope, the access and security requirements, the responsibilities on each side, and the purchasing approach under this contract. Before choosing between suppliers, what to look for in a provider is the companion to this page, and you are welcome to describe your project to us.
Frequently Asked Questions
Does TIPS 230601 establish all of the security requirements for an IT consulting project?
No. The contract settles how an eligible member may purchase and on what commercial terms. The security requirements for a particular project are set by the purchasing organization and written into the documents it issues.
What happens to the consultant's accounts when the project ends?
Whatever was arranged at the start. Accounts created for the engagement with an expiry date close on their own. Accounts that were not created that way depend on somebody remembering, which is why the expiry belongs in the access decision rather than in the closeout checklist.
Does TIPS 230601 require cyber liability insurance?
The reviewed contract states minimums for general liability, automobile liability, workers' compensation and umbrella liability. It does not establish a universal cyber liability requirement. A purchasing organization may still make that coverage a condition of a particular order.
Can federal funding affect security requirements?
Yes, depending on the funding source. Federally funded purchases can carry additional procurement, records, audit, subcontractor and supply-chain obligations, all of which are cheaper to identify at scoping than at closeout.
Are supply-chain restrictions relevant to IT projects?
They can be. The covered telecommunications provision at 2 CFR 200.216 reaches equipment and services from named entities and their affiliates, and it applies where federal award funds are used.
If something goes wrong during the project, does the supplier have to tell us, and how fast?
Only on the terms agreed. The contract documentation reviewed here sets no universal notification timeframe for consulting work, so an organization that needs one should put a number in the ordering document and name the person who receives the call.
We are buying a two-week assessment rather than a large project. Does any of this apply?
Proportionately. A short engagement still involves access, and access is most of the risk described here. The access record, the incident contact and the closeout step are worth a page of writing on any engagement. The rest scales with what the work touches.