The procurement document for whatever you're bidding on will hopefully specify what the system security specifications are (especially if it's an RFP or Procurement Contract). If not, there might be a Q&A session where you can ask prior to bidding.
You might also try looking at procurement docs that have already been released. Have a look around grants.gov, assuming you're US-based.
An industry peer would probably give you the best answer, such as someone who's already won a similar contract.
