The GSA Semiannual Regulatory Agenda includes plans to formalize
requirements in the General Services Administration Acquisition
Regulation (GSAR) concerning reporting cyber incidents that
potentially affect GSA or its contractors.
The GSA plans to update cybersecurity requirements in the GSAR
by requiring contractors to (i) protect the confidentiality,
integrity and availability of unclassified GSA information and
information systems from cybersecurity threats and vulnerabilities;
and (ii) report cyber incidents that could potentially affect the
GSA or its customer agencies.
First, the GSA intends to propose a rule regarding Information
Systems Security that updates GSAR 552-239-70, Information
Technology Security Plan and Security Authorization, and GSAR
552.239-71, Security Requirements for Unclassified Information
Technology Resources. As previously noted, this rule will
"mandate contractors protect the confidentiality, integrity,
and availability of
