The contracting officer must include the clause at 3452.239–71 (Department information security and privacy requirements) in all solicitations and contracts.