Insurance for Government Contractors in Northern Virginia: FAR Minimums, Bonds and Cyber Rules

Why government contracting changes the insurance conversation

Northern Virginia is home to a deep bench of small and mid-sized firms that support federal agencies: IT and cybersecurity providers in Reston and Herndon, consultants and program managers in Arlington and Tysons, and specialty trades that work on federal property throughout Fairfax County and beyond. For these businesses, insurance is not only a risk decision. It is a contract compliance item, and a missing endorsement or a short limit can delay the start of work.

The good news is that the rules are written down. This guide walks through the federal baseline, the clause that applies on government installations, Virginia's own requirements, bonds, and the cyber rules that now shape many defense contracts.

The federal baseline: FAR 28.307-2

When a contracting officer requires insurance, the Federal Acquisition Regulation sets the minimum types and amounts in FAR 28.307-2:

Two points are worth emphasizing. First, these are minimums; your contract can require more. Second, the federal auto minimums are higher than Virginia's own requirement. The Virginia DMV lists minimum liability limits of $50,000 for injury or death of one person, $100,000 for injury or death of two or more people, and $25,000 for property damage on policies effective on or after January 1, 2025. A business auto policy written at the state minimum would fall short of the FAR bodily injury figures.

Working on a government installation: FAR 52.228-5

Contracts that require work on a government installation commonly include the clause at FAR 52.228-5, Insurance, Work on a Government Installation. Under that clause:

For a prime contractor, that last point is easy to overlook. Collecting and tracking subcontractor certificates is part of the job, not a courtesy.

Virginia workers' compensation

The Virginia Workers' Compensation Commission states that employers that regularly employ more than two part-time or full-time employees must carry workers' compensation coverage. Temporary, seasonal and part-time workers count toward that number, and when a business hires subcontractors in the same trade or to fulfill its contracts, the subcontractor's employees can be included in the count. The Commission notes there are no waivers and no exceptions for covered employers.

The penalties are real. An uninsured employer faces a civil penalty of up to $250 for each day uninsured, to a maximum of $50,000 plus costs, along with liability for injured employees' benefits.

If your team will work overseas on a U.S. government contract, a separate federal law may apply. The U.S. Department of Labor explains that the Defense Base Act requires covered government contractors and subcontractors to secure workers' compensation insurance for employees working overseas on qualifying contracts. That is a specialized coverage, and we will tell you plainly when a referral is the right answer.

Bonds: the Miller Act and Virginia's own rule

On federal construction contracts, FAR 28.102-1 applies the Miller Act's requirement for performance and payment bonds to contracts above $150,000. For construction contracts greater than $35,000 but not greater than $150,000, the contracting officer selects two or more payment protections, such as a payment bond, an irrevocable letter of credit or a tripartite escrow agreement.

State and local work in Virginia follows Virginia Code § 2.2-4337. For nontransportation-related construction contracts over $500,000 awarded to a prime contractor, performance and payment bonds are required, and transportation-related projects over $350,000 that are partially or wholly funded by the Commonwealth carry the same requirement. The statute also allows a public body to require bonds on smaller contracts.

Bonding is underwritten much like credit. Financial statements, work-in-progress schedules and a clear record of completed projects all help, and it pays to start that preparation before a bid is due.

Cyber requirements on defense contracts

Two rules shape the cyber conversation for defense contractors.

DFARS 252.204-7012. This clause requires contractors to rapidly report cyber incidents, defined as within 72 hours of discovery, to the Department of Defense at dibnet.dod.mil, and to preserve images of affected systems and relevant monitoring data for at least 90 days from submission of the incident report.

CMMC. A DFARS rule published in the Federal Register took effect November 10, 2025. Under it, contracting officers may not award a contract, task order or delivery order to an offeror that does not have a current CMMC status posted in SPRS at the level the solicitation requires, and primes must confirm a subcontractor's current CMMC status before awarding a subcontract that involves federal contract information or controlled unclassified information.

Insurance does not make a company compliant. A cyber liability policy is a financial tool that may help pay for incident response, notification and certain liability after an event, depending on its terms. It works best alongside a compliance program, not in place of one. When we review a cyber policy for a defense contractor, we look closely at how it treats contractual obligations and regulatory matters.

The rest of the contractor program

Beyond what the FAR spells out, many task orders and subcontracts ask for professional liability (errors and omissions), and growing firms often add directors and officers liability, employment practices liability and an umbrella. Read your contract's insurance language line by line; the requirement is whatever the contract says, and a certificate that does not match it can hold up an award or a start date.

A contract-to-coverage checklist

1. Pull every insurance clause from the prime contract, each subcontract and any teaming agreement.
2. List each required coverage, limit and endorsement, including the 30-day cancellation notice language from FAR 52.228-5 where it applies.
3. Confirm your headcount against Virginia's workers' compensation threshold.
4. Identify any overseas work that may fall under the Defense Base Act.
5. Check bond requirements for federal or Virginia construction work before you bid.
6. Match your cyber policy and incident plan to the 72-hour DFARS reporting window.
7. Set up a system to collect and track subcontractor certificates.

How Prominent helps

Prominent Insurance Services is an independent agency headquartered in Wilmington, Delaware, licensed for personal and commercial lines in Delaware, Pennsylvania, New Jersey, Maryland and Virginia. We serve Northern Virginia clients from our Wilmington headquarters and do not maintain a local office there. Our work with government contractors starts with the contract: we map each requirement to coverage, review endorsements and certificates, and compare options from multiple appointed carriers. We cannot promise a price or that a particular market will offer terms, but we can make sure your program matches what the contracting officer will ask to see.

Disclaimer: This article is general education, not legal advice. Insurance requirements depend on your contracts, your operations and the policy language. Coverage is subject to underwriting and the terms of each policy. Consult your attorney about contract terms and your licensed agent about coverage.