GSA Requires IT Security Plans

Under a new General Services Administration ("GSA") rule, contractors providing information technology ("IT") supplies, services or systems to GSA will be required to submit an IT Security Plan that describes contractor compliance with federal cybersecurity regulations. The new rule applies in the case of IT contracts and orders awarded after January 6, 2012.

When one is required, contractors will have to submit an IT Security Plan within 30 days of contract award, provide written proof of IT security authorization six months after award and verify once a year that the IT Security Plan remains viable. Plan requirements will apply to all work performed under the contract, whether performed by the prime contractor or any subcontractor.