GSA Issues New Rule Heightening Contractor Requirements Regarding Information Technology Security

In an effort to strengthen federal IT security, the U.S. General Services Administration has issued a final rule heightening IT security standards. The new standards apply to all prime contractors and subcontractors that provide the GSA with information technology supplies, services, or systems if the contractor will have physical or electronic access to government information that directly supports the GSA's mission.

Going forward, contractors will have 30 days after award to submit an IT Security Plan that describes the processes and procedures that will be followed to ensure proper security of IT resources and that outlines compliance with federal cybersecurity regulations. In addition, contractors must: (1) provide written proof of IT security authorization six months after award; (2) verify that the IT Security Plan remains valid on an annual basis; and (3) allow the GSA to access contractor and subcontractor facilities, operations, documents, databases, systems,