The shape of the award, and where the gap opens
State data and analytics awards arrive in a narrow set of shapes. A Medicaid eligibility or claims module. A statewide longitudinal data system joining K-12, higher education, and wage records. A DOT crash and traffic warehouse. A public health surveillance rebuild. An unemployment insurance modernization. A revenue analytics platform. Values run from roughly two million dollars to well past a hundred million, terms of three to five years with option periods, and exactly one prime named on the award document. The state signs one contract and holds one throat to choke. Everything else about the delivery team is a private arrangement the state still gets to inspect.
The gap that opens after award is rarely generic. It is specific and it is technical. A team that can move a thirty-year-old mainframe extract into a governed lakehouse without breaking the federal report that depends on it. An engineer who can build a scoring model that a hearing officer can defend on the record. A cloud architect who can hold a security boundary through an authorization review while the front end is still being built. That work has to start in the first ninety days or the schedule never recovers, and hiring for it takes longer than ninety days.
We take that seat. Our team builds production AI, ML, data, and cloud systems, led by a former professor in technology who ranks in the top 0.1 percent of more than 200,000 competitors on Kaggle and holds seven cloud certifications, with twenty years of production federal delivery across five consulting firms, three of them federal. We hold a standing bench of named engineers, licensed professional engineers, and domain specialists across health, transportation, energy, and public-sector data. What follows is the contracting side of putting a team like ours under a state prime, written for the person who has to paper it.
Where state data platform primes most often add outside engineering
Editorial weighting from public solicitation reading and practitioner experience. Illustrative, not a measured statistic.
The subcontract is a mirror, and the mirror is the point
A state subcontract is not a services agreement with a compliance appendix stapled on. It is a mirror of the prime contract, and the clauses that matter are the ones that flow down without change. Read the prime contract first, then read the subcontract against it. Anything in the state's terms that binds the prime and touches the sub's scope should appear in the subcontract in the same words. Anything invented in the subcontract that has no source in the prime contract is a negotiation, not a requirement, and both parties should know which is which before signature.
Six flow-downs carry the most weight on a data platform. Termination for convenience, which the state almost always holds and which the prime almost always passes through in full. Suspension and stop-work, including who pays for demobilized staff during the stop. Records and audit access, which under federally funded state programs runs three years from submission of the final expenditure report per 2 CFR 200.334, and which many states extend to five or seven by their own statute. Nondiscrimination and equal opportunity. Suspension and debarment certification under 2 CFR Part 180 as adopted at 2 CFR 200.214, checked against SAM.gov exclusions at signature and again at each option exercise. Byrd anti-lobbying certification under 31 U.S.C. 1352 for any contract above one hundred thousand dollars in federal funds.
Two more show up on any award funded through a federal grant. The prohibition on covered telecommunications equipment at 2 CFR 200.216 reaches every device in the delivery path, including a subcontractor's own laptops. And Appendix II to 2 CFR Part 200 lists the provisions the state must include in its contracts, which is the fastest way to predict the redline before it arrives.
Payment terms, and the one word that decides the risk
Pay-when-paid and pay-if-paid look nearly identical on the page and behave very differently in a bad quarter. Pay-when-paid sets timing: the prime pays the sub within a stated number of days after the state pays the prime. Pay-if-paid attempts to make the state's payment a condition precedent, meaning that if the state never pays, the sub never gets paid. Courts in several states will not enforce pay-if-paid without explicit language, and some refuse it outright, but the safe move is to strike the conditional form and set a hard outside date. Sixty days from an approved invoice, paid or not, is a reasonable outside date on a state program.
State prompt-payment statutes help more than most subs realize. Texas Government Code Chapter 2251 requires a prime paid by a governmental entity to pay its subcontractors within ten days of receipt. Florida Statutes section 287.0585 sets fifteen days. Where such a statute exists, cite it in the subcontract rather than paraphrasing it, and add the statutory interest remedy. FAR 52.232-40 is a useful reference point in negotiation: it obligates federal primes to accelerate payments to small business subcontractors, which is a posture a state prime can adopt voluntarily.
Retainage is the other pressure point. Five to ten percent held against final acceptance is common on state IT work and is often passed straight through, so a sub delivering an early increment can carry retainage for two years on work the state accepted in month four. Tie release to milestone acceptance rather than contract closeout.
Insurance: what the certificate has to actually say
Insurance requirements pass through nearly verbatim, and the delay almost never comes from the coverage. It comes from the endorsements. A sub can hold every required limit and still hold up a start date for three weeks because the certificate does not carry the right endorsement language.
Typical state IT and data platform requirements run: commercial general liability at one million dollars per occurrence and two million aggregate; professional liability, also written as errors and omissions, at one to five million depending on contract value; cyber liability and network security coverage at one to five million, which is the line most likely to be raised on a platform holding health or tax data; automobile liability at one million combined single limit; workers' compensation at statutory limits with employers' liability commonly at one million each accident, each employee, and policy limit; and an umbrella or excess layer at one to five million sitting over general liability, auto, and employers' liability.
The endorsements are where the review actually happens. Additional insured status for the state and the prime on the general liability policy, written with an ISO CG 20 10 for ongoing operations and a CG 20 37 for completed operations. Primary and non-contributory wording, so the sub's policy pays first. Waiver of subrogation for the state and the prime on general liability and workers' compensation. Thirty days notice of cancellation, ten for nonpayment. The certificate is an ACORD 25, and its description of operations box should name the contract, the project, and the additional insureds exactly as the state spells them.
One correction saves a week of back-and-forth. Professional liability policies generally do not accept additional insureds, because the coverage responds to the insured's own professional acts. When a state form demands additional insured status on every line, the accepted resolution is to carry professional liability at the required limit, provide the certificate showing it, and confirm in writing that additional insured status is not available on that form of coverage. Primes who have run state data work before accept that immediately. It also matters whether the professional and cyber policies are claims-made, which they usually are, because that pulls in a retroactive date earlier than the contract start and an extended reporting period, two or three years past final acceptance.
Bonding, and the letter of credit that usually replaces it
Bonding on services is less universal than on construction and more common than most software firms expect. The Miller Act at 40 U.S.C. 3131 through 3134 requires performance and payment bonds on federal construction contracts above one hundred fifty thousand dollars, and the state analogues, generally called Little Miller Acts, do the same for state construction. Neither reaches a pure IT services award on its own. What reaches it is the state's own procurement rule or a term written into the solicitation, which on large platform awards frequently requires a performance bond of five to twenty percent of annual contract value, or an irrevocable standby letter of credit in the same amount.
A prime holding a state performance bond will sometimes try to pass the full bond obligation to a subcontractor carrying a fifteen percent work share. That is a mismatch, and it prices the sub out. Three resolutions work. Scale any bond obligation to the sub's own work share and its own dollar value, not the prime contract total. Substitute a parent guarantee or a letter of credit where the state's rule permits it, which is cheaper and faster than surety underwriting for a services firm. Or replace the bond with a liquidated remedy tied to milestone acceptance, which is what a state actually wants: the increment delivered, not a claim filed.
Bid bonds mostly resolve themselves, since a proposal bond attaches to the prime's response and not the sub's letter of intent. Where one is required, the sub's contribution is usually a financial statement or bank reference supplied under a nondisclosure agreement.
Protected data, and the categories that decide the whole build
Every state data platform sits on at least one protected category, and the category drives architecture, staffing, and hosting more than any technical preference does. Name the categories in week one.
Protected health information. A state Medicaid, public health, or behavioral health platform makes the agency a covered entity or a hybrid entity, the prime a business associate, and the engineering sub a subcontractor business associate. Since the 2013 Omnibus Rule, that downstream sub is directly liable under HIPAA, not merely liable to the prime. The chain requires a written business associate agreement at every link under 45 CFR 164.502(e) and 45 CFR 164.308(b), with the security-side content requirements at 45 CFR 164.314(a). Breach notification from a business associate to the covered entity runs no later than sixty calendar days under 45 CFR 164.410, and nearly every state contract compresses that downstream to twenty-four or seventy-two hours. That is an engineering obligation, because detection has to be automated rather than discovered in a monthly review. The minimum necessary standard at 45 CFR 164.502(b) governs what the analytics team sees, and where a reporting use case allows it, de-identification under Safe Harbor at 45 CFR 164.514(b)(2) or expert determination at 45 CFR 164.514(b)(1) removes a large share of the downstream control burden.
Federal tax information. Revenue departments and many eligibility systems carry FTI, governed by IRS Publication 1075. This is the category most likely to surprise a prime late. Publication 1075 requires specific contract language, background investigations on personnel with access, agency notification to the IRS Office of Safeguards forty-five days before a contractor is granted access, and no access from outside the United States. That forty-five-day clock has to be started by the agency, which means the prime has to identify the sub's cleared personnel long before they are needed.
Criminal justice information. Public safety and next-generation 911 platforms fall under the FBI CJIS Security Policy, which requires a signed CJIS Security Addendum for each individual with access, fingerprint-based background checks, and United States based personnel and support.
Education and workforce records. A statewide longitudinal data system runs on FERPA, and the vendor's access is usually authorized through the school official exception at 34 CFR 99.31(a)(1), which requires direct control over the vendor's use and re-disclosure. Substance use disorder records carry the separate and stricter regime at 42 CFR Part 2.
The 45-day IRS notification is the most common schedule slip
If any part of the platform touches federal tax information, IRS Publication 1075 requires the state agency to notify the Office of Safeguards 45 days before a contractor gains access. The sub's named personnel have to be identified and background-checked before that notice goes out. On a 90-day mobilization, this is the item that has to move in week one.
Personally identifiable information without one of those overlays still carries state breach statutes in all fifty states and a control baseline written into the contract, usually NIST SP 800-53 Revision 5 at moderate, sometimes NIST SP 800-171 where federal data flows through. Hosting adds a layer. Texas requires cloud services to hold TX-RAMP certification under Texas Government Code section 2054.0593, several states run an equivalent, and others accept a StateRAMP or FedRAMP package instead. A sub running a component in its own tenant should answer that question in the teaming call, not in the security review.
Federal funding rewrites the terms, including who owns the code
Most large state data platforms are paid for substantially with federal dollars, and that changes the contract in ways a purely commercial reading misses. Medicaid systems draw enhanced federal financial participation under 42 CFR 433.112, which conditions the money on a list of standards and conditions including modularity, reusability, and open interfaces. Health and human services systems acquired with federal participation fall under 45 CFR Part 95 Subpart F, and 45 CFR 95.617 is the clause that decides ownership: the state holds all ownership rights in software designed, developed, or installed with federal financial participation, and the federal government reserves a royalty-free, nonexclusive, irrevocable license to reproduce and use it.
That is a different world from a federal SBIR award, where data rights under DFARS 252.227-7013 and 252.227-7014 protect a small business's technical data for a defined protection period. On a federally funded state platform, the default is that the state owns the deliverable outright. A subcontractor with real intellectual property has one clean move: define background intellectual property precisely in an exhibit, list it before signature, grant the state and the prime a perpetual, irrevocable, royalty-free license to use it within the platform, and keep ownership of the underlying component. That is a normal, accepted structure. Discovering the question at deliverable acceptance is not.
Federal funding also brings participation goals. USDOT-funded state contracts carry the Disadvantaged Business Enterprise program at 49 CFR Part 26, with an enforceable goal and a commercially useful function test, meaning a DBE sub has to perform real work rather than pass paper through. States also run their own minority, women-owned, and service-disabled veteran programs with separate certification bodies. Federal certifications do not transfer automatically and state certification takes weeks, so it belongs in the capture conversation.
How work share reaches the state
The state has to know who is doing the work, in what proportion, and whether that proportion held. That happens through a small number of documents, each with a deadline attached to a different stage of the award.
Work-share documentation, stage by stage
Two details cause most of the trouble. First, the percentage on the disclosure form is normally computed on total contract value, and it is a commitment, not an estimate. If the sub's committed share was eighteen percent and actual payments land at nine, a compliance officer will ask why, and on a DBE-goaled contract that question can carry a remedy. Any real reduction should move through a documented change, not a quiet drift. Second, the percentage and the scope narrative have to match across the disclosure form, the letter of intent, and the executed subcontract. Three documents describing the same work three different ways is the single most common finding in a post-award review.
The comparison a federal prime should keep in view
Teams that subcontract routinely on federal work meet a different set of defaults on the state side. The differences are manageable and they are not intuitive.
| Term | Federal prime subcontract | State prime subcontract |
|---|---|---|
| Flow-down source | FAR and agency supplement clauses, listed by number in the subcontract | Prime contract terms plus 2 CFR Part 200 Appendix II where federal funds pass through |
| Payment protection | Accelerated payment to small business subs under FAR 52.232-40 | State prompt-payment statute where one exists, otherwise negotiated outside date |
| Deliverable ownership | Government license rights under DFARS 252.227-7013 and 7014, contractor retains data | State ownership, with a federal license reserved at 45 CFR 95.617 on HHS-funded systems |
| Insurance | Often light on services contracts, driven by the prime's own policy | Specified in the solicitation, with endorsements verified before start |
| Small business credit | Subcontracting plan goals under FAR 19.7 on large awards | State DBE, MBE, WBE, or SDVOB program with state-issued certification |
| Records retention | Generally three years after final payment | 2 CFR 200.334 as a floor, frequently extended to five or seven by state statute |
The pre-signature checklist
Run this before the subcontract is executed, not after. Every item here has delayed somebody's mobilization.
- Prime contract read in full, with the flow-down clauses mapped clause by clause into the subcontract
- Pay-if-paid struck, outside payment date set, prompt-payment statute cited where one applies
- Retainage on the sub's portion tied to milestone acceptance, not final contract closeout
- Certificate of insurance issued with additional insured, primary and non-contributory, and waiver of subrogation endorsements attached
- Professional liability retroactive date confirmed earlier than contract start, with the tail period priced
- Any bond or letter of credit scaled to the sub's own work share and dollar value
- Protected-data categories named, with the business associate agreement chain and any IRS or CJIS clocks started
- Background intellectual property listed in an exhibit with a perpetual license granted, ownership retained
- Indemnity capped at insurance limits, with carve-outs stated for breach, infringement, and gross negligence
- Scope narrative and work-share percentage identical across disclosure form, letter of intent, and subcontract
Bottom line
A state data platform award is won on the technical approach and delivered on the paperwork that lets the technical people start. The prime that names its protected-data categories in week one, produces a correctly endorsed certificate in week two, and shows the state a subcontractor whose scope narrative matches across all three documents is building in month one while a competitor is still resolving an additional insured question. None of that is hard. It is specific, and it rewards a teammate who has read the clauses before.
Frequently asked questions
Yes. A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of a business associate is itself a business associate and is directly liable under HIPAA. The chain requires a written agreement at every link under 45 CFR 164.502(e) and 45 CFR 164.308(b), with the security content requirements at 45 CFR 164.314(a).
General liability at one million per occurrence and two million aggregate, professional liability and cyber liability at one to five million each, auto liability at one million, statutory workers' compensation with employers' liability, and often an umbrella layer. The endorsements matter as much as the limits: additional insured, primary and non-contributory, and waiver of subrogation.
On health and human services systems acquired with federal financial participation, 45 CFR 95.617 gives the state all ownership rights in software developed with those funds and reserves a royalty-free, nonexclusive, irrevocable license to the federal government. A subcontractor protects its own components by listing background intellectual property in an exhibit before signature and granting a license rather than transferring ownership.
Through a disclosure form in the proposal stating scope, dollar value, and percent of total contract value, a signed letter of intent, written state consent after award, and monthly utilization and payment reporting. The percentage is a commitment, and reductions should move through a documented change.
Not by statute. The Miller Act at 40 U.S.C. 3131 and the state Little Miller Acts reach construction, not services. Bonding on a state data platform comes from the solicitation or the state's own procurement rule, typically five to twenty percent of annual value, and an irrevocable standby letter of credit is frequently accepted as a substitute.