Cultural resource management (CRM) firms routinely handle sensitive archaeological, tribal, historical, and environmental data that is subject to federal and state confidentiality, retention, and security requirements. Yet most CRM practitioners have not been formally trained in the IT and data-handling obligations embedded within agency contracts. Failure to meet these obligations, whether through improper file sharing, insecure devices, mishandled GIS data, or inadequate access controls, can result in confidentiality breaches, regulatory violations, project delays, and damage to client trust.

This presentation offers a practical, CRM-focused overview of IT compliance requirements applicable to firms performing work under NHPA, NEPA, ARPA, and state-level cultural resource laws. The session will explain the technical expectations that government clients assume contractors understand: secure data storage, encrypted transmission, MFA, controlled access, digital chain-of-custody, endpoint security, retention schedules, cloud configurations, and device management. Attendees will learn how to implement reliable, compliant workflows using commonly available tools such as Microsoft 365, cloud storage, secure file portals, VPN solutions, and enterprise-grade authentication systems.

The goal is not to turn CRM professionals into IT engineers, it is to provide the knowledge needed to meet contractual obligations confidently and avoid inadvertent compliance failures.