Data Security and IT Compliance for Subcontractors

Subcontractors working with the Texas Department of Transportation must implement comprehensive administrative, physical, and technical safeguards to ensure the protection of all TxDOT data, particularly personally identifiable information. These safeguards are mandatory and must align with applicable federal and state data security standards to mitigate risks of unauthorized access, disclosure, or loss. Any security breach involving TxDOT data must be reported immediately upon discovery, with no delay, to enable rapid response and mitigation. Subcontractors are also required to flow down all data security and compliance obligations to any lower-tier vendors or service providers they engage, ensuring that the same level of protection is maintained throughout the entire supply chain. This obligation extends to all levels of subcontracting and applies regardless of contract size or scope, reinforcing a uniform standard of data stewardship across all parties involved in supporting TxDOT operations.