Category: IT Security & Solutions

Posted on

Taking A.I.M. at EIS

Enterprise Infrastructure Solutions (EIS) transition

The transition to Enterprise Infrastructure Solutions (EIS) is one critical path for agencies to evolve to more modernized and secure IT infrastructures and away from legacy technologies that are vulnerable to security risks — a high priority for this Administration. With the President’s Executive Order on Improving the Nation’s Cybersecurity, it’s important to remember that the transition to EIS is not about shutting down expiring contracts; it’s ultimately about the safety, security, and sustainability of the federal government’s IT infrastructure.

The most recent EIS transition milestone came and went on March 31, when agencies were expected to have disconnected at least 50 percent of their services from the expiring Networx, Washington Interagency Telecommunications System (WITS) 3, and Local Service contracts.

While the data illustrates agencies are making progress, with 55% of the federal government’s inventory remaining to be disconnected, there is still much work to be done. Therefore, we urge our agency partners to take A.I.M. at EIS:

  • Assess their status and accelerate their progress
  • Disconnect & transition their Inventory
  • Mitigate risk to ensure mission operations continue

Assessing status and accelerating progress

Less than two years remain before the Networx, WITS 3, and Local Service contracts expire on May 31, 2023. Though the September 30, 2022 deadline for 100% disconnect from expiring contracts is a little over 15 months away, we want to remind agencies that a lack of transition progress could result in service disconnection much sooner. Please assess your progress against several important dates that are outlined in the revised Project Plan for Closeout of Transition and accelerate actions accordingly:

  • June 30, 2021 – Agencies that are not transitioning to EIS will have services disconnected. On this date, agencies for whom GSA has provided a report for a price-only fair opportunity decision, but have yet to award the task order, will also be disconnected.
  • August 31, 2021 – Agencies that have not awarded any EIS task orders for their solicitations will be disconnected.
  • September 30, 2021 – Agencies that have not awarded EIS task orders for all their solicitations will be disconnected.
  • October 1, 2021 – GSA will no longer accept or process any exception requests for the expiring contracts (Networx, WITS 3, and Local Service Agreements). All new services should be ordered from the EIS contracts or other viable contracts.
Enterprise Infrastructure Solutions Transition Timeline with remaining milestone dates and upcoming Closeout Phases for 2021 June 30, 2021. Agencies that are not transitioning to EIS will have services disconnected. On this date, agencies for whom GSA has provided a report for a price-only fair opportunity decision, but have yet to award the task order, will also be disconnected . August 31, 2021. Agencies that have not awarded any EIS task orders for their solicitations will be disconnected. September 30, 2021. Agencies that have not awarded EIS task orders for all their solicitations will be disconnected. October 1, 2021. GSA will no longer accept or process any exception requests for the expiring contracts (Networx, WITS 3, and Local Service Agreements). All new services should be ordered from the EIS contracts or other viable contracts.
Enterprise Infrastructure Solutions Transition Timeline with remaining milestone dates and upcoming closeout phases for 2021

The next major milestone for EIS transition is on March 31, 2022, which calls for 90% of services disconnected from expiring contracts. With less than 12 months to go, we urge agencies to accelerate progress, so as not to fall further behind.

Inventory: enhanced focus on disconnecting and transitioning inventory to EIS

Government-wide, we are behind the EIS curve. 11 of 17 large agencies and 15 of 25 medium-size agencies have yet to disconnect even 50 percent of their services as of March 31, 2021. Ultimately, missing transition milestones and continued reliance on expiring contracts risks disruption of critical services delivered to the public.

Mitigating risk to ensure mission operations continue

The more agencies fall behind the established milestones, the greater the risk to their mission. This not only leaves less time for transition-related activities ahead of the September 2022 milestone, but it will also increase the potential that agencies may be “stuck” waiting for disconnect and transition services to be rendered. In particular, agencies that delay their EIS contractor selection for replacement services may find themselves “in line” behind those that have already chosen a contractor and made transition progress. This further slows progress for disconnecting services from the expiring contracts and connecting new services.

The extended contracts expire on May 31, 2023 and there will be no extensions. We invite our agency partners to ask themselves “Will we complete transition on time?”. If your agency will not complete transition on time, contingency planning must start now.

The time for EIS transition action is now. Regardless if your agency is in the acquisition or implementation phase, know that GSA wants to actively support agency transitions. If your agency is struggling, GSA can provide services such as:

  • An inventory of complete services that need to be transitioned, including custom reports for your agency
  • Technical, acquisition, and ordering assistance, plus automated tools to directly assist agencies with expediting EIS task orders
  • GSA in-scope reviews of agency solicitations
  • Regular outreach to agencies’ Integrated Transition Teams to monitor transition progress and provide guidance

If your agency needs help with transition, please contact the IT Customer Service Center at 855-482-4348, or send an email to ITCSC@gsa.gov. We encourage you to reach out to your agency leadership. Include Chief Information, Acquisition, and Financial Officers in conversations on EIS transition, financials, and risk.

Posted on

Zero Trust Architecture: Acquisition and Adoption

What is Zero Trust Architecture (ZTA)?

Zero Trust is not a technology, but an approach to cybersecurity. It assumes all cyber networks and traffic are hostile in nature, and that any implicit trust in users should be eliminated. Now, more than ever, Zero Trust concepts are becoming increasingly important to an agency’s IT security posture as we see an increase in cyber attacks.

Zero Trust Architecture (ZTA) is a cybersecurity strategy that employs narrow and dynamic network defenses where every action, and use of resources is questioned, and where users are given the minimum levels of access to information needed to do their jobs.

To fully implement ZTA, organizations need to focus on the integration and implementation of a range of tactics and technologies. We can no longer rely on the concept of “trust, but verify”. Instead, agencies must verify, re-verify, and continue re-verifying with added layers of cybersecurity to establish true ZTA.

Why is ZTA important now?

Recent sophisticated cyber attacks and the shift to remote/virtual work environments highlight the importance of focusing on cybersecurity. The recent Sunburst and Colonial Pipeline cyber attacks exposed vulnerabilities in government and private sector computer systems. These attacks are a stark reminder that a weakness anywhere is a weakness everywhere. Furthermore, as organizations move to a mix of cloud-based, on-premises, and hybrid network models, traditional perimeter-focused network defenses can no longer protect an organization’s information communication technology assets. To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, government agencies must move quickly to modernize their cybersecurity capabilities and accelerate towards the adoption of ZTA.

In 2020, the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207, Zero Trust Architecture was released to provide agencies with guidance and detailed recommendations to improve their security posture using the core principles of ZTA. More recently, Executive Order 14028 “Improving the Nation’s Cybersecurity” requires all Federal agencies to develop a plan to implement ZTA in an effort to modernize and strengthen cybersecurity standards and detection.

What can agencies do to embrace ZTA?

Although there is no single end-to-end, comprehensive Zero Trust network solution, movement towards a Zero Trust security posture does not require agencies to rip and replace existing cybersecurity tools, hardware, or software products. Rather, agencies can make incremental steps to “re-tool” existing products to adhere to Zero Trust principles and supplement with GSA-offered products, services, and solutions to achieve ZTA.

GSA created a Zero Trust Architecture Buyer’s Guide for acquisition, network architect, and cybersecurity professionals who are seeking to implement ZTA. The guide is a roadmap to ZTA and provides helpful concepts and best practices. Zero Trust security models currently range between five and seven pillars. For the purposes of facilitating an acquisition-based perspective, GSA chose to represent a combination of eight unique pillars that agencies should consider when implementing a robust and efficient Zero Trust security model.

Zero Trust Architecture Pillars-User, Device, Network, Infrastructure, Application, Data, Visibility and Analytics, Orchestration and Automation

Getting to Zero Trust is a journey. Moving to ZTA will take time, and agencies will be at different starting points as they implement a Zero Trust strategy. When evaluating a ZTA solution, agencies should consider how well the product or service addresses these eight pillars and to what extent.

Zero Trust Pillars

PillarDescription
UserInvolves focus on user identification, authentication, and access control policies which verify user attempts connecting to the network using dynamic and contextual data analysis.
DevicePerforms “system of record” validation of user-controlled and autonomous devices to determine acceptable cybersecurity posture and trustworthiness.
NetworkIsolates sensitive resources from being accessed by unauthorized people or things by dynamically defining network access, deploying micro-segmentation techniques, and control network flows while encrypting end-to-end traffic.
InfrastructureEnsures systems and services within a workload are protected against unintended and unauthorized access, and potential vulnerabilities.
ApplicationIntegrates user, device, and data components to secure access at the application layer. Security wraps each workload and compute container to prevent data collection, unauthorized access or tampering with sensitive applications and services.
DataInvolves focus on securing and enforcing access to data based on the data’s categorization and classification to isolate the data from everyone except those that need access.
Visibility and AnalyticsProvides insight into user and system behavior analytics by observing real-time communications between all Zero Trust components.
Orchestration and AutomationAutomates security and network operational processes across the ZTA by orchestrating functions between similar and disparate security systems and applications.
Zero Trust Pillars

How can GSA help?

There are many elements of a Zero Trust solution that crosscut and incorporate GSA contract offerings. The information provided in the Zero Trust Architecture Buyer’s Guide can help agencies mature their Zero Trust implementation plans.

There are multiple GSA resources that support Zero Trust efforts, like the Highly Adaptive Cybersecurity Services (HACS) Special Item Number (SIN) which provides access to vendors who have passed an oral technical evaluation for cybersecurity services, making it easier for agencies to find quality vendors.

The Continuous Diagnostics and Mitigation (CDM) Tools SIN provides access to cybersecurity products included on the Department of Homeland Security Cybersecurity & Infrastructure Security Agency’s Approved Products List. Agencies can use these and other comprehensive GSA solutions to support the design and deployment of architectures that follow the tenets of Zero Trust.

Posted on

Think Cloud, Think GSA

Think Cloud, Think GSA FAST 2021 promo image - event July 15

We know you use cloud computing for more than just migration and storage. Some agencies need a trusted consultant to plan long-term strategy. Others are ready to build their own applications and deploy next-generation technology. GSA cloud experts want to alleviate your acquisition pain and answer your questions directly. To that end, the Information Technology Category and 3 other GSA offices are offering a guided tour of GSA’s cloud portfolio at our “Think Cloud, Think GSA” event from 1-3 PM Eastern on Thursday, July 15.

Our cloud experts will:

  • Answer your cloud technical and acquisition questions
  • Explore GSA cloud products and services offered by multiple GSA offices
  • Explain the buying options available to help agencies move through their cloud adoption journey.

Here are a few session teasers:

The Technology Transformation Services’ (TTS) Cloud Center of Excellence helps your agency innovate with embedded, on hand expertise. Understand how the Cloud Center of Excellence empowers agencies to undertake IT modernization and how their acquisition, security and technology teams are used as an engine of organizational change.

The Information Technology Category’s (ITC) Cloud Acquisition Team gives those agencies that know what cloud products and services they want the information needed to acquire them. Hear about the Cloud Information Center, the pre-competed Multiple Award Schedule Cloud SIN, and more.

The Technology Transformation Services’ (TTS) Cloud.gov supports government agencies in getting to the cloud quickly, securely, and in a compliant manner. Three Cloud.gov experts will cover how their Platform-as-a-Service offering fits any step of a customer’s journey to the cloud, and how they are just a simple InterAgency Agreement away.

The Assisted Acquisition Services’ (AAS) FedSIM office works with mature organizations that have complex acquisition needs. Hear from the director Chris Hamm on how this white glove services span acquisition, financial, and project management for the full acquisition life cycle.

Think Cloud, Think GSA event promo image

Sonny Hashmi, GSA Federal Acquisition Service Commissioner, will give an opening keynote about how cloud policy and technology has progressed over the past decade. Sam Navarro, Director of the Customer Strategic Solutions Division, will act as Master of Ceremonies.

This event is open to government and industry. Participants are eligible to earn 2 Continuous Learning Points (CLPs). Registration is free and open to all.

Register and reserve your virtual seat today.

Posted on

VETS 2 Provides IT Services Core Capabilities

GSA’s Veteran Technology Services 2 (VETS 2) Governmentwide Acquisition Contract (GWAC) for IT Services provides critical IT solutions with comprehensive core capabilities to meet diverse agency IT requirements, including new and emerging technologies.

We recently conducted a survey of our 69 highly qualified VETS 2 industry partners to better understand their core capabilities and to highlight their strengths. This survey provides great insights into how VETS can help agencies — and we wanted to share.

We received responses from 97 percent of VETS 2 contractors and we’ve depicted those results below in graph format. Here are some highlights:

The top four types of IT Services they provide are:

  • IT Operations and Maintenance
  • Software Development
  • Information and Communications Technology
  • IT Security

VETS 2 contractors have successfully performed a variety of IT services for the government, the top five areas of past performance include:

  • IT Service Desk
  • Cyber Security
  • Agile Software Development
  • Cloud Computing
  • CyberOps

I also want to point out that 90 percent of VETS 2 industry partners hold a secret or top secret security clearance and 84 percent have an audited and approved cost accounting system. This means that no matter what your IT requirements are, our VETS 2 industry partners are well positioned to help.

VETS 2 is recognized by the Office of Management and Budget as Best-in-Class and is the only GWAC set-aside exclusively for Service-Disabled, Veteran-Owned Small Businesses. It’s the ideal vehicle to meet your IT mission needs.

Curious if VETS 2 is right for you? We’re happy to review your scope of work (SOW). This is a free, no obligation service and we’ll provide a written opinion within 5-7 business days. Request a SOW review here.

Visit our website to learn more about VETS 2.

Please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.

To get updates for this blog, please sign up on the right-hand side of the page where it says Sign up for Blog Updates.

Posted on

FAST 2021: Incorporating IT Security into Acquisitions

Join us May 13th at 1:00 pm EDT for a live webinar led by GSA’s IT Acquisition experts as we explore:

  • Benefits in shifting from a compliance model to the cybersecurity maturity model
  • Adopting a supply chain risk evaluation approach in government contracting
  • Easy to understand acquisition planning packages (e.g., playbooks, checklists, templates)

The 3-hour session features an overview of requirements and evaluation factors used in developing the 2nd Generation Information Technology (2GIT) blanket purchase agreement; and a quick look into the GSA’s IT Solutions Navigator connecting buyers with resources, tools, and decision support for IT procurements.

This is the third session in GSA’s 2021 monthly Federal Acquisition Service Training (FAST) Conference series. Each session is worth up to 3 Continuous Learning Points. You can find the full lineup of events here.

Registration is open and free for agency and industry partners. Reserve your virtual seat today – we look forward to seeing you there!

Please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.

To get updates for this blog, please sign up on the right-hand side of the page where it says Sign up for Blog Updates.

Posted on

Introducing the IT Vendor Management Office: a new government-wide collaborative effort to solve the toughest challenges in federal IT acquisitions

The last months have been a whirlwind of activity for the new government-wide Information Technology Vendor Management Office (ITVMO). We not only chartered the ITVMO, but have started working with several partner agencies and IT acquisition experts from across government to identify existing resources that can assist agencies with their buying decisions. The ITVMO brings together the most critical players in the federal IT acquisition landscape to solve challenges agencies and vendors face when buying and selling IT products and solutions.

Launched in October 2020, the ITVMO is a government-wide effort to amplify the benefits of managing vendor engagement in the IT Category to make IT acquisitions faster and more cost effective. The ITVMO serves as a trusted independent advisor and advocate to help agencies buy common IT goods and services. As a one-stop shop, the ITVMO will leverage government-wide IT procurement data, conduct market research, and develop shared agency acquisition knowledge to support agencies’ buying decisions.

There are many programs and initiatives across government that are interested in improving how government buys IT. The ITVMO is unique in that it is a collaborative effort amongst partners in Category Management (CM) with the most critical IT acquisition Best in Class (BIC) contract vehicles and associated programs including:

  • The General Services Administration (GSA);
  • The National Aeronautics and Space Administration (NASA);
  • The National Institutes of Health (NIH);
  • The Department of Defense (DOD);
  • The White House Office of Management and Budget (OMB) Office of Federal Procurement Policy (OFPP).

Through this collaboration, the ITVMO will advance the goals of IT Category Management (CM) to improve how the government buys common IT goods and services and enable the government to act more as a single entity by sharing best practices and acquisition intelligence as well as eliminating the unnecessary duplication and redundancy that exists between federal agencies.

What’s Happening & What’s Next

One of the central drivers of CM is to mature federal IT acquisitions so that the government acts more like a single buyer rather than many independent agencies. By creating a space where some of the biggest and most impactful federal IT acquisitions programs and initiatives can collaborate and solve shared problems, establishing the ITVMO is a major step toward that goal.

The ITVMO is chartered and led by an Executive Steering Committee (ESC) comprised of several agencies including those with the largest IT BIC vehicles. The ESC determines the strategic direction and project priorities for the ITVMO to solve problems for agencies and vendors alike.

To identify shared challenges and opportunities throughout government, the ITVMO surveyed hundreds of IT and acquisition experts including the Chief Information Officers Council (CIOC) and the Chief Acquisition Officers Council (CAOC) as well as several communities of practices. The ITVMO team also conducted listening sessions with industry groups. The data and feedback gathered from across government is driving the challenges the ITVMO seeks to address in the near future.

ITVMO Customer Segments

The ITVMO’s primary customers are the programs and offices responsible for making buying decisions at each agency, and the vendor community. On January 27th, the ITVMO hosted an Open House for agencies to provide an overview of the ITVMO’s mission and services, and to answer any questions from the community. More information about the ITVMO Open House, including a video recording of the event, is available to government employees.

Based on customer feedback, the ITVMO is working on several products and services that will be made available to agencies in the near future, including:

  • Continuing a Small Business Webinar Series developed in partnership with the IT Government-wide Category and the American Council for Technology and Industry Advisory Council Small Business Alliance so agencies and vendors can learn how GSA’s Federal Acquisition Service Multiple Award Schedules Program will allow agencies to more easily procure IT products and services from small businesses.
  • Vendor Profiles that provide agencies with pricing information, specific vendors’ terms and conditions, and best practices for negotiating with that vendor.
  • Deep Vendor Intelligence crowdsourced from IT acquisition experts from across the federal government participating in integrated project teams (IPTs).
  • A Technology Life Cycle Assessment to provide agencies with insights into buying emerging technology and updating existing systems and services to meet evolving needs.
  • A deep dive and review of current Cost Avoidance Methodologies used by IT BIC acquisitions vehicles. The ITVMO is working closely with GSA’s IT Category to provide recommendations on how to improve the accuracy and reliability of cost avoidance methodologies and the underlying contract data.

If any of the above interest you, we would love to connect with you. Please feel free to reach out to the ITVMO inbox at itvmo@gsa.gov.

Coming Soon…

The ITVMO recently launched the first of several IPTs made up of the federal government’s foremost experts in working and negotiating with specific IT vendors. The IPTs will produce recommendations and strategies that can be shared and leveraged throughout government.

ITVMO - Integrated Project Teams

On May 12, 2021, The ITVMO will also host an Industry Day intended for our industry and vendor partners to learn about the mission of the ITVMO and the best way to collaborate with the ITVMO and federal IT acquisitions staff.

Finally, the ITVMO will soon launch our website to share the ITVMO’s latest updates and activities, post relevant templates and resources, and direct users to the relevant information to meet their IT acquisition needs.

Additional insight can be found on our ITVMO MAX page, and you can sign up for our newsletter. If you have any questions or general inquiries, please feel free to reach out to us at the ITVMO inbox at itvmo@gsa.gov.

Please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.

To get updates for this blog, please sign up on the right-hand side of the page where it says Sign up for Blog Updates.

Posted on

FY20: Exceptional Work in an Exceptional Year

The Numbers Are In – Biggest Year on Record for GSA ITC!

In Fiscal Year 2020, the Information Technology Category (ITC) recorded more than $30 billion in business volume across its portfolio. For context, this accounts for nearly a third (33%) of the $89 billion total that was spent on IT across all federal agencies in FY20.

Accordingly, this past fiscal year proved to be a record year in other categories as well:

  • IT spending through the Multiple Award Schedule accounted for an impressive $18.1 billion of the $30 Billion total, bolstered by its $12.7 Billion in new obligations. In FY20, MAS IT impressively posted 18% annual growth in new obligations.
  • On the Small Business front, ITC accounted for $7.1 Billion in utilization from Government Wide Acquisition Contracts (GWACs), Schedules, and Telecommunications
  • ITC issued a single award via its telecommunications branch to the tune of $2.5 Billion, using the Enterprise Infrastructure Service (EIS) Contract. The award was made on behalf of the Department of Health and Human Services, and over the lifetime of the contract, the agency estimates it will save more than $700 million.
  • ITC accounted for more than $2 billion in savings and cost avoidance to their customers

FY20 Efforts in Review

The 2020 Fiscal Year drove change through every part of our lives. COVID-19 spurred dramatic change in government work culture and led to rapid technological adaptation across all agencies. A good deal of ITC’s increased business volume can be attributed to agencies transitioning to mobile-friendly technology. However, this unprecedented spending is also due to agencies acknowledging that GSA is a solid partner as they make big IT changes and choices about how to invest. We’re out front and focused when it comes to customer service, agile response to emergency needs, and delivery of mission-enabling and emerging technologies.

In 2020, customer agencies turned to GSA’s schedules program, assisted acquisition services and governmentwide acquisition contracts (GWAC) to fulfill pandemic-driven requirements as well as regular demand for products and services. Our success embodies the trust that federal agencies have put in us and our ability to address elements that our customers most care about:

  • Speed of acquisition
  • Assistance with mobile-friendly technology adoption
  • Technical and market expertise
  • Data transparency
  • General customer service

Agencies have turned to and relied on us to ensure their mission continuity and transition to a more untethered workforce.

In FY20, ITC launched the Information Technology Acquisition University (ITAU) to make it easier to learn about GSA’s products, IT solutions available through GWACs, MAS, and more. ITAU is a digital training platform for emerging technologies, their acquisition, GSA-specific contract training and more.

Additionally, ITC enhanced the Cloud Information Center, the GSA-curated federal resource hub for all things cloud, continuing to place valuable cloud computing resources in the hands of agencies.

These resources are ways that GSA is meeting the rise in demand for virtual access to our subject matter experts and more online learning platforms.

Looking Forward

In FY21, GSA is doubling down on emerging technologies as the way of the future. The 8(a) STARS III and Polaris government-wide acquisition vehicles will have Artificial Intelligence offerings (Machine Learning, Robotic Process Automation, Natural Language Processing), edge computing and more. As the Cybersecurity Maturity Model Certification (CMMC) effort ramps up and Supply Chain Risk Management (SCRM) principles are emphasized, GSA will continue to prioritize security as a core tenet of acquisitions.

As my Deputy Assistant Commissioner Keith Nakasone likes to remind me, agencies are coming to GSA to leverage our IT expertise and the buying power of the government. They want to know that the products they’re adding to their IT footprint aren’t jeopardizing their networks. To that end, the CMMC level can be designated as needed at the task order requirement level. Large contracts such as the 2nd Generation Information Technology (2GIT) hardware/software Blanket Purchase Agreements, have SCRM built in as a key operational component. Ultimately, GSA understands it plays a crucial role and has a considerable responsibility for an agency’s IT health.

Going into FY22, ITC will continue to provide the tools needed to successfully modernize while prioritizing cost-efficiency, expediency, and security. Leveraging Best In Class (BIC) contracts is one way. Taking advantage of online resources like ITAU and the CIC is another. Give your agency a reason to acquire with confidence — work with GSA for your next IT acquisition.

As always, follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.
To get updates for this blog, please sign up on the right-hand side of the page where it says Sign up for Blog Updates.

Posted on

Continuous Monitoring: Keeping Your System Up to Date and Prepared for Cyberattacks

Continuous monitoring of IT systems is an evolving process. It adapts as new technologies and capabilities become available and as organizations are faced with advanced and persistent threats. However, the core strategies of continuous monitoring lay the foundation for safe and secured federal IT systems.

Continuous monitoring helps agencies identify, resolve, and understand key insights regarding certain risks to their information systems. The Risk Management Framework (RMF) process consists of several steps that include preparing a system for authorization, authorizing the system, and continuously monitoring the system until the next authorization process begins. The monitoring step is essential for agencies that want to minimize risks to their security systems.

As mentioned in previous posts, the Highly Adaptive Cybersecurity Services (HACS) Special Item Number (SIN) solution is available for agencies in need of cybersecurity services, including RMF. GSA’s HACS solution connects agencies with vendors who have passed an oral technical evaluation for cybersecurity services, making it easier for agencies to find quality vendors to assist with continuous monitoring strategies and Security Operations Centers (SOCs) activities.

After agencies obtain Authorization to Operate (ATO), they move into the continuous monitoring step of the RMF process. Though continuous monitoring strategies can vary by agency, usual tasks include near real-time risk management and ongoing authorization based on the system environment of operation. This step’s dynamic processes determine if a system’s security controls continue to be effective over time.

Risk Management Framework (RMF) image
Disclaimer: RMF steps can vary based on an organization’s cybersecurity needs.

RMF services are available through GSA’s HACS SIN. A Statement of Work (SOW) for the RMF process can be found on the HACS website and includes example language for procuring services for the Monitor Step. The SOW outlines several subtasks that make up the continuous monitoring phase of RMF.

Roles and Responsibilities within the Continuous Monitoring Strategy

As part of the continuous monitoring process, the agency will oversee information system and environment changes. This process involves determining the security impact of proposed or actual changes to the information system and its environment of operation.

Security Control Assessments

An Information Owner (IO), Security Control Assessor (SCA), Information System Security Officer (ISSO), and Information System Security Engineer (ISSE) will be responsible for ongoing security control assessments. The IO is an inherently governmental position; however, contractors can provide support for the other roles in most situations. In these assessments, personnel examine the technical, management, and operational security controls within an information system. This practice ensures that a system is in accordance with the agency’s monitoring strategy.

Risk Determination

The Chief Information Security Officer (CISO) performs ongoing risk determination and acceptance as a part of continuous monitoring. This task consists of reviewing the reported security status of the information system (including the effectiveness of security controls employed within, and inherited by, the system) on an ongoing basis. The CISO aims to determine whether the risk to the agency’s system remains acceptable. If a risk is not acceptable, remediation will take place. This CISO is in an inherently governmental position; however, contractors can provide subject matter expertise and recommendations for risk determinations.

Ongoing Remediation

The IO and ISSO take part in ongoing remediation actions throughout the continuous monitoring process. Along with the Information System Owner (ISO) and the Common Control Provider (CCP), these personnel conduct remediation actions based on the results of ongoing monitoring activities, the assessment of risk, and outstanding items in the Plan of Action and Milestones.

For more information on HACS RMF services and how using the HACS SIN can make it easier for your agency to monitor its systems, visit the HACS homepage or download the customizable RMF Statement of Work (SOW).

Please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.

To get updates for this blog, please sign up on the right-hand side of the page where it says Sign up for Blog Updates.

Posted on

Polaris: Women Owned Small Businesses, Get SBA Certified

On December 31, 2020, GSA released the Draft Request For Proposal (RFP) for comment for our next generation small business GWAC, Polaris. With the creation of Polaris, GSA will build on the success of the now-expired Alliant Small Business GWAC by providing additional opportunities for small businesses, including but not limited to, HUBZone and woman-owned small business (WOSB) firms. We couldn’t be more proud of our team for putting this together, and we’re looking forward to your feedback.

WOSBs are Key Contributors

As we indicated in the draft RFP, GSA is considering socioeconomic pools to include WOSBs to maximize competition within the Information Technology Category. It’s very important to GSA that WOSBs are included in our contracts as they are key contributors to the government marketplace. It’s vital that the government have access to a robust pool of SBA certified WOSBs to ensure access to as broad of an industrial base as possible.

GSA is encouraging WOSBs to respond to the draft RFP to help ensure the following:

  1. there is a sufficient pool of WOSBs that are SBA certified
  2. to meet the annual federal goal of 5 percent of all federal contract dollars spent being awarded to WOSBs
  3. to help increase competition in the IT emerging technologies and innovations space.

You’re a WOSB, Why Get Involved?

In FY20, the federal government invested more than $87 billion in IT, with approximately $47 billion allocated to IT services. Federal agencies awarded $15.6 billion in IT services to small businesses, with more than $5 billion awarded through IT Category contracts. Every day, small businesses are making a huge impact in helping agencies achieve their missions.

SBA WOSB Certification

As of July 15, 2020, The U.S. Small Business Administration (SBA) implemented Congress’ changes to the WOSB Federal Contracting Program, as outlined in the 2015 National Defense Authorization Act (NDAA).

We’re encouraging WOSBs to work with the SBA, which implements and administers the WOSB Federal Contracting Program, in order to understand and navigate the certification process to ensure the right certifications are in place.

  • Before firms can compete for WOSB Federal Contracting Program set-aside (including Polaris) contracts, they must apply for certification through the new process on beta.certify.sba.gov
  • For more information about the new application process, please review the following fact sheet.
  • Additionally, beta.Certify Knowledge Base is a valuable resource for firms to get started learning about this new platform with how-to videos, user guides.

WOSBs, Helping Light the Way

We couldn’t be more excited about the future of our small business GWAC program and Polaris is going to help light the way. To be truly successful, we need your help in getting WOSBs certified.

To follow the Polaris conversation subscribe to the GSA Interact page: Small Business GWAC Community of Interest. Also, please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.

To get updates for this blog, please sign up on the right-hand side of the page where it says Sign up for Blog Updates.

Posted on

Veteran Owned Companies Bring Cybersecurity Expertise to Federal Customers

As we celebrate Veterans Day, we want to take a moment to appreciate all of the men and women who contribute to this great nation through their service in our military. America’s veterans are one of our most valued resources. Veterans bring a unique skill set, knowledge, and experience to everything they do; and GSA has been able to tap into their valuable expertise through our Service-Disabled Veteran-Owned Small Business (SDVOSB) contract for IT Services, VETS 2.

GSA’s VETS 2 Governmentwide Acquisition Contract is available to all federal customers. Agencies purchasing IT services through the VETS 2 contract demonstrate how prevalent veterans are in supporting mission-critical IT services needs across the federal landscape. One of the important core capabilities of VETS 2 is Cybersecurity. The SDVOSB firms on the contract have done the work, and 77 percent of the firms have extensive experience in cybersecurity. More than 60 of the VETS 2 industry partners have a secret or top-secret facilities clearance. These companies are well established in the IT industry. The background they bring with their previous military experience has been key to their success.

The IRS, Treasury, DHS, DoD, Army, and Air Force have all tapped into the expertise of our VETS 2 Industry Partners. They have placed task orders on the contract for IT Security and Cybersecurity requirements. Since the inception of the VETS 2 contract in February of 2018, there have been 21 task orders specifically to support IT Security needs within the government. This shows that veterans can provide the specialized knowledge, skills, and abilities that are needed today.

The single largest task order that has been issued on the VETS 2 contract was completed by GSA’s Federal Systems Integration and Management Center (FEDSIM) on behalf of the United States Army Pacific (USARPAC). This task order will help USARPAC in providing a quality-focused process and capability that enables effective sustainment and modernization of critical Command, Control, Communications, Computers (C4), and IT systems. These services include site surveys, engineering, design, procurement, logistics, implementation, operations and maintenance, knowledge management, cybersecurity, and training of new and existing C4 IT systems. This is an excellent example of the broad capabilities available through VETS 2.

2020 has been hugely successful for the VETS 2 contract, with 97 task orders worth more than $1 billion. This contract is only in its third year and is already surpassing expectations. There are 69 industry partners on the contract with a variety of specialized IT services core capabilities. VETS 2 is also a Best-in-Class contract as designated by the Office of Management and Budget. Federal customers using VETS 2 will receive socioeconomic credit toward small business goals as well as credit toward their
Spend Under Management goals.

On Veteran’s Day each year, we reflect on the hard, mission-enabling work our veterans continue to deliver for our government every day, and I couldn’t be more proud of our VETS 2 team and industry partners.

For more information about the industry partners on the contract, check out our VETS 2 website.

Please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.

To get updates for this blog, please sign up on the right-hand side of the page where it says Sign up for Blog Updates.