Most government contractors pour their compliance energy into federal requirements — FAR, DFARS, NIST, CMMC — and stop there. That's a mistake. State cybersecurity and data-protection laws can apply to you based on whose personal data you hold, no matter which agency you contract with or where your company sits.
Why State Law Reaches Federal Contractors
State data laws generally key off residency of the affected individuals, not the nature of your contract. A defense contractor headquartered in Virginia that holds the personal data of California and New York residents can owe duties under California and New York law. Federal contracting doesn't preempt these obligations — it sits alongside them.
Two Categories to Track
1. Breach-notification laws. Every state has one. They require notifying affected individuals — and often a state agency or attorney general — after a breach of personal information. The catch is that they differ on the details: what counts as personal information, how fast you must notify, and what the notice must say. A single incident affecting residents of a dozen states can trigger a dozen overlapping, slightly different obligations.
2. Comprehensive privacy laws. A growing roster of states — California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, and a lengthening list — have enacted comprehensive consumer-privacy statutes. Several impose "reasonable security" duties and require data-protection assessments, which function as de facto security requirements.
Where Federal and State Overlap (and Don't)
The good news: if you already implement NIST SP 800-171 or a comparable control set for your federal work, you've likely satisfied much of what state "reasonable security" expectations contemplate. The trap: breach-notification timelines are entirely independent. Meeting DFARS's 72-hour DoD reporting window does nothing to satisfy a state's separate consumer-notification deadline. You need both clocks running.
A Simple Way to Get Ahead of It
1. Inventory your personal data — what categories you hold and which states' residents they cover. 2. Build a breach-notification matrix for those states: trigger, deadline, recipient, content. 3. Check for comprehensive-law duties — reasonable security, assessments, consumer rights. 4. Review annually. New states pass laws every legislative session.
Key Takeaways
- State laws apply based on whose data you hold, independent of federal rules.
- All 50 states have breach-notification laws with inconsistent deadlines — map them in advance.
- Strong NIST-based controls help with "reasonable security," but notification timelines stand alone.
Get oriented on the State Requirements page, then confirm your full obligation set with Find My Requirements.