Contractors handling federal information must safeguard it under FAR 52.204-21 and, for defense, DFARS 252.204-7012. Review your controls, train your people, test your incident response.