Free Records Retention Schedule for Federal Contractors

The 24-row master retention schedule that reconciles FAR, Davis-Bacon, OFCCP, OSHA, CMMC, IRS, and state record-hold rules into one operator-built tracker, so your closeout binder, audit response, and disposal calendar all run off the same source of truth.

Why federal contractors need a reconciled retention schedule, not seven separate rule lists

Most federal contractors do not have a records retention problem. They have a records reconciliation problem. The retention rules are written down. They are just written down in seven different places, by seven different agencies, with seven different trigger events, and almost none of them agree with each other. FAR 4.703 says three years after final payment for most contract records. The Davis-Bacon Related Acts say three years after the work is completed for certified payrolls. OFCCP and EEO say two years for personnel and applicant flow records. Except when you are a covered federal contractor with 150 employees and a $150K contract, in which case it is two years from creation or until the next OFCCP review, whichever is longer. OSHA says five years for the OSHA 300 log, thirty years for employee exposure records, and the entire life of employment plus thirty years for medical files. CMMC and CUI handling rules sit on top of all of that for any contract touching controlled unclassified information. State tax authorities want seven years for payroll tax records. The IRS wants four. Your insurance carrier wants the COI binder kept for the full statute of repose, which can be ten or twelve years depending on the state.

The result, on every federal contractor I have worked with: nobody actually knows when a document is allowed to be destroyed. Some firms keep everything forever, which is a discovery and storage cost problem. Other firms destroy on the shortest applicable schedule and lose key records before the longest applicable rule has run out, which is a much worse problem. The most common pattern is the worst of both. Boxes of paper certified payrolls in a storage unit from 2014, no index, no idea what is still in scope, and a DOL audit notice that just landed in the office manager’s inbox.

This template is the reconciliation layer. It captures every record category a federal contractor actually handles, certified payrolls, COIs, contracts and modifications, change orders, RFIs, submittals, inspection records, safety logs, training records, M/WBE compliance reports, drug-free-workplace artifacts, EEO and OFCCP records, OSHA 300 and 300A logs, environmental sampling, hazard communication records, CUI artifacts, FOUO documents, financial statements, tax records, accounts receivable, project closeout binders, as-built drawings, IT and access logs, and for each one resolves the longest applicable retention period across every regulatory authority that touches it. One row, one record category, one defensible disposal date.

What this schedule is NOT: it is not legal advice, it is not your firm’s record-retention policy, and it does not replace your attorney’s review. Retention rules change. State rules vary. Contract clauses can extend retention beyond the FAR baseline (DOE, NASA, and DoD CUI contracts routinely add five-to-ten years on top). The schedule is the operator’s working document. The thing your office manager and project closeout team run off, the thing your CFO and compliance officer review annually, the thing your records counsel updates when the rules move. It exists to replace the spreadsheet that is currently glued together with red highlights and three years of email.

Use this schedule as the master index for your closeout binder, your annual records purge, your DOL audit response, and your CMMC document-handling policy. Update it every time a contract clause extends retention beyond the baseline. Re-check it annually against the live regulations.

Who this retention schedule is for

• Federal general contractors managing portfolio-wide retention across active and closed projects
• 8(a) federal subs keeping closeout binders defensible for SBA and contracting-officer review
• Prime contractors running master compliance dashboards across multiple federal awards
• Office managers and records administrators running annual disposal calendars
• Compliance officers and CFOs owning audit response and FAR/CMMC documentation policies
• Project-closeout coordinators assembling the post-final-payment record set on every job

If you are tracking Davis-Bacon documents specifically, you will also want our certified payroll WH-347 review checklist. It is the upstream control that creates the certified payroll records this schedule sets retention against.

The 24 record categories the schedule reconciles

The schedule covers 24 record categories every federal contractor handles. Each row resolves the longest applicable retention period across FAR, Davis-Bacon, OFCCP, OSHA, CMMC, IRS, and state authorities. Set up once, reviewed annually, updated whenever a contract clause extends a retention period:

Items

1. Certified payroll (WH-347 and state variants). Retention 3 years after completion of work per 29 CFR 5.5(a)(3)(ii) for Davis-Bacon. State mini-Davis-Bacon variants (California DAS-140, New York PW-39) often extend this. California requires 4 years under state wage law. Trigger event is work completion, not contract closeout, which means the clock starts on the last day of payroll for the project, not final payment.
2. Contracts and contract modifications. Retention 3 years after final payment per FAR 4.703(a). Original signed contract documents, all bilateral modifications, and unilateral change orders go in this row. CMMC contracts extend this to 6 years for the contract file when CUI clauses are present. Track separately when the same firm holds both standard and CMMC contracts.
3. Change orders and directives. Retention follows the underlying contract. 3 years after final payment per FAR 4.703(a). Constructive change documentation (RFIs, field directives, time-and-materials tickets that became change orders) gets pulled into this row when it is the basis for a change order. Litigation hold extends retention indefinitely.
4. Subcontractor certificates of insurance (COIs). No specific federal retention rule, so default is FAR 4.703 (3 years after final payment), but most contractors retain for the full state statute of repose, often 8-12 years for construction. Insurance counsel typically advises retaining all COIs for the full repose period regardless of FAR baseline. Track active COIs separately in a lifecycle tracker.
5. Subcontract agreements and amendments. Retention 3 years after final payment per FAR 4.703(a) at minimum. Most firms retain for the full state statute of repose alongside the COIs. Subcontract files include the agreement, all amendments, the prequalification packet, and the close-out lien releases. The whole packet is one retention unit.
6. Requests for information (RFIs) and responses. No specific federal retention rule. Most firms apply the FAR 4.703 baseline (3 years after final payment) for general RFIs and extend to the state statute of repose for RFIs that drove design or scope changes. RFIs cited in change orders or claims get retained with the change-order or claim file.
7. Submittals and approvals. Retention follows the contract file. 3 years after final payment per FAR 4.703(a). Approved submittals, rejected submittals with the reasons for rejection, and the chain-of-custody records for each. As-built submittals get pulled into the as-built drawing retention row.
8. Inspection records and quality reports. Retention varies by record type. Federal-acceptance inspection records follow FAR 4.703 (3 years after final payment). Independent third-party inspection reports often extend to the state statute of repose. Daily QA/QC reports follow the contract file.
9. Daily reports and field logs. Retention 3 years after final payment per FAR 4.703(a) for the contract record. Daily reports often serve as the contemporaneous evidence base for change orders, claims, and delay analyses, so litigation-prone projects extend retention to the state statute of repose.
10. Safety logs and OSHA 300/300A. OSHA 300 log retention is 5 years per 29 CFR 1904.33. The OSHA 300A annual summary follows the same 5-year rule. OSHA 301 incident reports also retain 5 years. The trigger event is the end of the calendar year the log covers, not project closeout, so the 2026 log retains through 2031 regardless of when the project closed.
11. Employee exposure records and medical surveillance. Retention 30 years per 29 CFR 1910.1020 for exposure records (chemical, hazcom, asbestos, lead, silica, noise). Medical records retain duration of employment plus 30 years. These two retention rules are the longest in the schedule and apply on virtually every construction project.
12. Hazard communication (HazCom) records. Safety Data Sheets (SDS) retention 30 years per 29 CFR 1910.1020 (treated as exposure records). HazCom training records retain 5 years per 29 CFR 1910.1200. Track separately because the trigger events differ. SDS retention runs from last use of the chemical, training retention from training date.
13. Training and certification records. General training records retain 5 years per OSHA. OSHA 10-hour and 30-hour training cards typically retain duration of employment plus 5 years. CMMC security awareness training retains the contract retention period (3-6 years post-final-payment). Project-specific safety training (site orientation, fall-protection refreshers) follows OSHA general retention.
14. Drug-free workplace records. Retention 5 years per the Drug-Free Workplace Act and DOT regulations where applicable. Construction firms with federal contracts under 41 CFR 81 (Drug-Free Workplace Act for federal contractors) retain employee certifications, drug-test results (when DOT-regulated), and drug-free-workplace policy acknowledgments.
15. OFCCP and EEO records. Retention 2 years from creation per 41 CFR 60-1.12(a) for affirmative action plans, applicant flow logs, hiring records, and adverse-impact analyses. Federal contractors with 150 employees and a $150K contract follow the longer “2 years or until next OFCCP review” rule. EEO-1 reports retain 2 years per the same authority.
16. M/WBE / DBE compliance reports. Retention 3 years after final payment per FAR 4.703(a) for federal projects, often longer per state DBE/MWBE rules. New York and Illinois have explicit 4-5 year retention rules. Track the M/WBE plan, all subcontractor utilization reports, and good-faith-effort documentation in this row.
17. Environmental sampling and SWPPP records. SWPPP (Stormwater Pollution Prevention Plan) records retain 3 years post-permit-coverage-termination per EPA NPDES rules. Environmental sampling data (air, water, soil) often retains longer per state environmental authority. 10 years is common. NEPA compliance documentation follows project record retention.
18. CUI artifacts and access logs. Retention per the contract’s CMMC clause. Typically 6 years post-final-payment for CMMC Level 2 contracts. NIST SP 800-171 control artifacts (access control logs, audit logs, incident response records, configuration management records) retain at least the contract retention period and often longer per the contract’s CUI marking guidance.
19. FOUO and other controlled-information records. Retention per the contract clause and the marking guidance for the document. FOUO (For Official Use Only) records typically follow standard contract retention (3 years post-final-payment) but the marking and handling controls extend the disposal protocol. NAID-certified destruction or DoD 5220.22-M wipe regardless of the retention period.
20. Financial statements and audit reports. Retention 7 years per construction-industry standard (driven by IRS audit window and CPA professional standards). Audited financials, internal financial statements, and external audit reports go in this row. Bonding-required financial statements often retain longer per surety requirements (10 years is typical).
21. Tax records (federal and state). Retention 7 years per state tax authority (most states), 4 years per IRS for federal income tax records, and 4 years per FUTA/SUTA for unemployment tax. The longest applicable rule controls. Most contractors apply 7 years across the board. Payroll tax records (941, 940, W-2s, 1099s) retain 4 years per IRS but are typically held 7 years to align with state rules.
22. Accounts receivable and lien-tracking records. Retention varies by state lien law and statute of limitations on collections. Most states impose 4-6 years on collections actions; the underlying A/R record retains for the longer of the collections SOL or the FAR 4.703 baseline. Lien waivers and payment-bond claim records retain through the bond’s claim window plus the project’s statute of repose.
23. Project closeout binders and as-built drawings. Closeout binder retention follows the contract file (3 years post-final-payment per FAR 4.703(a)) but as-built drawings often retain for the full state statute of repose plus the building’s design life. Government clients (GSA, USACE, NAVFAC) frequently require permanent retention of as-builts. As-builts on private commercial projects typically retain 10-20 years.
24. IT and system access logs. Retention per the contract’s CMMC or cybersecurity clause. CMMC Level 2 typically requires 1-3 years for general access logs, longer for security incident logs and audit logs (often 6 years to align with CMMC contract retention). General contractors without CMMC contracts often follow industry-standard 1-year retention for non-security IT logs.

Retention schedule

How to set up and run the schedule across your portfolio

Set up the schedule once, then run it on a fixed cadence. For each record category your firm handles:

• Pull the current FAR, Davis-Bacon, OFCCP, OSHA, CMMC, IRS, and applicable state retention rules. Most are available on agency websites; legal counsel can confirm edge cases.
• Walk through all 24 rows. If your firm does not handle a category (no DOT-regulated drug testing, no environmental sampling), mark the row “N/A” and move on. The row stays in the schedule for completeness but is not active.
• Fill the controlling citation, retention period, trigger event, storage format, and disposal method for each active row. The trigger event and disposal method are the two most-often-wrong fields. Double-check both against the cited regulation.
• Assign an owner role to each row and circulate to those role-holders for sign-off. Retention without a named owner does not survive the next office reorg.
• Schedule the next review for 12 months out. Put it on the compliance calendar. Add quarterly mid-year checks if you have active CMMC contracts.
• Use the schedule as the disposal authority every time records are purged. Office Manager and CFO co-sign disposal logs. Litigation-hold notices override the schedule. Verify against active hold lists before any disposal cycle.
• When a new federal contract is awarded, scan the contract clauses for retention extensions and capture them per contract number. The contract clause overrides the baseline schedule for documents tied to that award.

Stop guessing on which retention rule applies

The 24 rows above take a federal-construction firm a full day to set up properly the first time, and another 90 minutes per quarter to re-validate against active contracts and changing regulations. Multiply by 50 active record categories across all your projects, 8 federal authorities, and 4 states of operation and you have built another part-time job out of records administration. Contracts Connected’s compliance dashboard keeps every record category indexed against the controlling regulation, every retention period anchored to the right trigger event, and every disposal pre-cleared against active litigation holds, so your office manager, CFO, and compliance officer all see the same schedule, the same disposal calendar, and the same audit-ready closeout binder for every active project.

For educational purposes. These templates, checklists, and trackers are operator-built starting points designed to help you move faster on the kind of work that usually drowns construction admins in email chains. They are not legal, insurance, accounting, or tax advice. Each project, jurisdiction, and contract has its own quirks. Review the document, refine the language, and consult your attorney, broker, CPA, or compliance officer before relying on it for a live project decision.

Frequently asked questions about federal records retention

Related templates

• Certified payroll (WH-347) review checklist for primesUpstream control creating Davis-Bacon records this schedule sets retention against.
• Subcontractor COI expiration trackerActive-COI lifecycle tracker; pair with this schedule for archived-COI retention.
• Subcontract package checklist (commercial)Subcontract-file completeness. Feeds the contract-records row of this schedule.
• Document numbering and naming convention guideNaming standard so retention rows index against findable file paths.