The contracting officer must include the clause at 3452.239-71 (Department information security and privacy requirements) in all solicitations and contracts.