GSA Requires IT Contractors To Create And Implement IT Security Plans: This May Only Be The Beginning

On January 6, 2012, the General Services Administration ("GSA") issued a final rule (77 Fed. Reg. 749 (Jan. 6, 2012)) requiring all prime- and sub-contractors providing the GSA with information technology ("IT") supplies, services, or systems to submit an IT security plan outlining compliance with federal cybersecurity regulations. The GSA acknowledges that "[t]his final rule may have a significant economic impact on a substantial number of small entities."  The new rule signals what may become standard for all government contractors, and perhaps all commercial entities, in the years to come, as the U.S. government (and private industry) react to the rapidly developing cybersecurity landscape.