General Services Administration Considers New Cybersecurity Requirements For Government IT Contracts

IT products and services are procured by the federal government through government-wide acquisition contracts ("GWACs") that allow federal agencies to purchase IT products and services from preapproved commercial IT vendors for a set period of time at pre-negotiated prices. With a GWAC in place, an agency need not establish open competition among IT vendors and instead may simply place a task order pursuant to the GWAC for the particular IT product or service to be procured. Aiming to make cybersecurity requirements applicable to federal IT contractors at the contract level rather than at the task order level, the General Services Administration invited public comment on a cybersecurity proposal that mandates that IT contractors have in place a Contract Cybersecurity Risk Management Plan as part of the GSA's next-generation GWAC acquisition process.