Posts

Posted on

IT GWAC Roundup

We’ve had so much news about our small business Governmentwide Acquisition Contracts (GWACs) over the last few months. I continue to get questions and requests for status updates from our friends in industry, so I thought it would be helpful to pull the latest updates together in one place. 

I’ll start by reminding everyone why we stand these contracts up. GSA’s small business GWACs enable the important missions of agencies across the federal government and drive progress on vital public policy objectives including the President’s Executive Order 13985 On Advancing Racial Equity and Support for Underserved Communities Through the Federal Government and the President’s Management Agenda (PMA) released by the Biden-Harris Administration in November.  

GSAs GWACs support the PMA in some key ways, including delivering mission-enabling technologies across government. They support deep relationships with the supplier community, helping industry understand how the PMA drives new and emerging government IT requirements to support key initiatives such as improving citizen interactions with the government and equipping the federal workforce to effectively deliver for the public. GWACs also make it easier for new suppliers, especially small and disadvantaged businesses, to gain valuable growth opportunities through the federal IT marketplace.

As we close out the year, there’s a flurry of activity in ITC around our GWACs and I am very proud and excited about the work my team is doing.

Polaris

Polaris will bring innovation to the small business community, federal agencies, and the acquisition workforce leading to substantial benefits to small businesses, improved technology for federal agencies, and greater flexibility for acquisition professionals across government.

Initial priorities on Polaris will be the creation of 4 pools to accommodate set-asides for:

  • small businesses; 
  • women-owned small businesses (WOSB); 
  • service-disabled, veteran-owned small businesses (SDVOSB), and 
  • businesses located in HUBZones.

We will solicit and award Polaris in phases to help our customers deliver on their missions and meet their socio-economic goals.

Our first priority is to release the request for proposals (RFP) for the small business and WOSB pools in late January/February 2022. The small business pool will be awarded first, in 2022. The WOSB pool will be awarded second. The HUBZone and SDVOSB RFPs and awards will follow.

Keep an eye on our Small Business GWAC Community of Interest for updates.

8(a) STARS III

8(a) STARS III successfully launched this summer with a 5-year base period, 3-year option, and a $50 billion ceiling to give agencies plenty of runway to plan for the future. The 2021 award was an important first step with an initial cohort of more than 400 8(a) industry partners gaining new access to the federal IT marketplace. 

This is a big deal for the Small Disadvantaged Businesses (SDB) community and we’re excited to see how they turn these opportunities into great outcomes.

We are working closely with our partners on a second 8(a) STARS III cohort for award in Q2 FY22 — stay tuned!

VETS 2

The VETS 2 GWAC is humming right along. In just 3.5 years, VETS 2 has an estimated $1.94 billion value from 148 task orders.

VETS 2 gives agencies access to a wide variety of customized IT services and solutions. It also helps agencies receive SDVOSB credit toward their Small Business Procurement Scorecard and Best-in-Class (BIC) Tier 3 credit toward Spend Under Management goals.

We’re committed to the SDVOSB community. VETS 2 will have a strong future as part of GSA’s suite of IT contract solutions for many years to come. We’re taking the necessary steps to execute the option period and doing all that we can to cement VETS 2’s future.

Together, VETS 2 and Polaris will deliver on our commitment to SDVOSBs. They’ll continue to provide value for our customers well into the future and help ensure there will be no gap in access to SDVOSB contract offerings from GSA.

Looking to the Future

The highly qualified companies on our GWACs (and those to come) can complete almost any IT service requirement including agile software development, artificial intelligence (AI), cloud computing, and other emerging technologies.

As we look toward 2022, GSA will remain focused on providing important solutions for our industry partners and customer agencies. It will remain a top priority for us in the new year.

Follow us on Twitter @GSA_ITC and LinkedIn, and subscribe for blog updates.

Posted on

GSA Celebrates American Veterans

This Veterans Day, I’m contemplating GSA’s long history of working with service-disabled, veteran-owned small businesses (SDVOSB). I’m proud of the work they do every day to help agencies across the federal government achieve their mission.

Our Governmentwide Acquisition Contracts (GWACs) like VETS 2 demonstrate our ongoing commitment to our Veteran community – and I want to make sure I communicate clearly that we believe VETS 2 will continue its success and have a strong future as part of GSA’s suite of IT contract solutions for many years to come. We’re taking the necessary steps to execute the option period and doing all that we can to cement VETS 2’s future.

VETS 2: the right IT solutions, right now

In just 3 ½ years, VETS 2 has an estimated $1.87 billion value from 145 task order awards.

VETS 2 gives agency customers access to a wide variety of customized IT services and solutions. It also helps agencies receive SDVOSB credit toward their Small Business Procurement Scorecard and Best-in-Class (BIC) Tier 3 credit toward Spend Under Management goals.

The highly qualified companies on VETS 2 can complete almost any IT service requirement including agile software development, artificial intelligence (AI), cloud computing, and other emerging technologies.

SDVOSB pool on Polaris

In addition to our ongoing support for VETS 2, GSA is broadening opportunities for Veterans to work with the federal government. We recently announced a new contract pool for SDVOSB firms on Polaris, a new next-generation GWAC.

Polaris will bring more innovation to the small business community, federal agencies, and the acquisition workforce. This innovation will lead to substantial benefits for small businesses, improved technology for federal agencies, and greater flexibility for acquisition professionals across government.

Polaris will have 4 pools: small business, women-owned small business (WOSB), SDVOSB and businesses located in HUBZones. These pools will be awarded in phases to help our customers deliver on their missions and meet their socio-economic goals.

Our first priority is to release the request for proposals (RFP) for the small business and WOSB pools January 2022. The small business pool will be awarded first, later in the year. The HUBZone and SDVOSB RFPs and awards will follow.

Subscribe to our Small Business Community of Interest on GSA Interact to keep up to date.

Veterans help government through two GSA GWACs

We’re committed to the SDVOSB community. Together, VETS 2 and Polaris will deliver on our commitment to SDVOSBs. They’ll continue to deliver value for our customers well into the future and help ensure there will be no gap in access to SDVOSB contract offerings.

Find out more about VETS 2 and discover customer training opportunities at www.gsa.gov/vets2. Please send any questions to vets2@gsa.gov.

Additional information about Polaris can be found at www.gsa.gov/polaris. Please send any questions to polaris@gsa.gov.

Posted on

Reducing Cyber Supply Chain Risks

From reports of large-scale cyber attacks such as Solarwinds to President Biden’s signing of Executive Order 14028, Improving the Nation’s Cybersecurity, cyber supply chain risks have been top of mind for policymakers and federal agencies governmentwide.

GSA is committed to helping agencies mitigate cyber supply chain risks. By understanding the threats, agencies are positioned to take defensive action against them.

Ecosystem threats

Government depends on a global supply chain ecosystem: vendors, distribution routes, technologies, laws, and policies. Each piece of this ecosystem works together to design, manufacture, distribute, use, and manage products and services.

However, these supply chains’ ecosystems can expose government organizations and enterprises to financial, governance and cybersecurity risks.

Of these risks, one of the most troubling is that someone will use vulnerabilities in a supply chain to carry out a cyberattack.

A supply chain cyber attack occurs when an attacker uses a trusted outside partner or vendor with access to a system’s data to infiltrate an information system.

Because supply chain attacks are difficult to prevent and can greatly harm any organization, federal agencies must identify, categorize, manage, and mitigate risks within their supply chains.

In its December 2020 report, the Government Accountability Office (GAO) assessed how 23 civilian CFO Act agencies’ implemented 7 Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) practices.

In their review, the GAO found that many agencies had not implemented the practices according to their evaluation criteria and that no agencies had fully implemented all 7 practices.

What you can do

You can take proactive information and operational technology acquisitions measures to reduce an organization’s cyber supply chain risks.

  • Evaluate your organizational structure. Set up a collective task force to secure your supply chain and empower this team to hold lower-level suppliers accountable and to have responsibility for overall supply chain security.
  • Identify and empower supply chain leadership. Review and monitor key contracts to verify that prime and subcontractors maintain security practices through the contract lifecycle. Threat intelligence and incident response capabilities must work together.
  • Put data protection and stakeholder communication processes in place. Set requirements for communicating and protecting data, specifically for incidents, breach notifications, and industry or legal reporting requirements.
  • Build trust by sharing threats with your supply chain partners. Prevent communication delays by being transparent about an attack or a potential breach. Transparent leadership and communication creates trust. Building that trust requires a commitment to straight talk, the ability to produce results, and the ability to restore trust when trust is lost.

GSA C-SCRM Resources

For the last 10 years, federal guidance and regulations have prioritized SCRM. This priority reflects the increasing threat of vulnerabilities in the nation’s supply chain.

We’re continuing to develop ways to help agencies reduce supply chain risk, like the Vendor Risk Assessment Program and the Cyber Supply Chain Risk Management Acquisition Community of Practice.

Vendor Risk Assessment Program

We are currently developing a program that can identify, assess, and monitor supply chain risks for vendors who do critical work for the federal government. It will audit supply chain risk processes or events and may include on-site assessments.

The following criteria will be monitored:

  • Risk of foreign ownership, control or influence;
  • Cyber risk; and
  • Factors that would affect the company’s vulnerability, such as financial performance.

If the risk assessment identifies supply chain risks, we will work with the vendor on a corrective action.

We take this seriously. Failing to resolve any identified risk may result in government action up to and including contract termination.

Cyber Supply Chain Risk Management Acquisition Community of Practice

In August 2021, we established a C-SCRM Acquisition Community of Practice (ACoP). It includes key acquisition stakeholders from GSA, Cybersecurity and Infrastructure Security Agency (CISA), Office of Management & Budget (OMB), and other federal agencies.

The goal of C-SCRM ACoP is to increase awareness and develop maturity in the areas of cyber-acquisitions and Information Communication Technology and Services (ICTS) supply chain risk management across the federal government.

Many federal departments and agencies need to mature C-SCRM capabilities, guidance, and training. This is particularly true for acquiring ICT hardware and software.

We need governmentwide contract language for getting ICT products that holds vendors accountable for assessing the risk of their supply channels, especially for embedded software.

To learn more about the C-SCRM ACoP or to join, email C-SCRM_ACoP@gsa.gov.

Coordination is key

Agencies must continuously monitor their interconnected IT ecosystem and establish the necessary contract requirements that ensure vendors are doing the same.

Stay up to date on the latest GSA C-SCRM initiative by following us on Twitter @GSA_ITC.

Posted on

Bringing GSA’s Polaris GWAC to Life

We’re proud of the work we do to support agency missions at GSA, and we recognize the very important role small businesses play in making that a reality.

GSA’s GWAC heritage

We’ve promoted the growth of the small business community in the US for decades. Through GSA’s Governmentwide Acquisition Contract (GWAC) program, we have built a solid foundation that connects the small business community to the federal IT market, promoting access to innovation, and supporting job creation nationwide. For decades, the GSA GWACs have served as a springboard for companies to grow and create jobs and opportunities.

Since the late 1990s, GSA’s GWACs have served as a gateway for federal agencies to access highly qualified information technology (IT) vendors. And, since their inception, customers have relied upon our small business GWACs to fulfill over $27 billion in IT requirements for agencies across government.

Small Business GWACs serving your mission

We want to keep improving on these important solutions to ensure they remain the contracts of choice for our industry partners and customer agencies. We’ve been hard at work on our current and next generation of contracts.

8(a) STARS III successfully launched (with more awards to come) this summer with a 5-year base period, 3-year option, and a $50 billion ceiling to give agencies plenty of runway into the future. This is a big deal for the Small Disadvantaged Businesses (SDB) community and we’re excited to see how they turn these opportunities into great outcomes! Even though 8(a) STARS II has officially sunset, existing task orders will continue being worked for several more years.

VETS 2 is humming along. With a little over three years of performance so far the contract already has $1.68B in total estimated value from 122 task orders. Agencies depend on VETS 2 every day to meet their missions.

With the creation of Polaris, our next small business GWAC, we’ll build on the success of these programs and become the first GSA GWAC to feature multiple socioeconomic groups through a single offering.

Polaris, a bright future

Polaris will bring innovation to the small business community, federal agencies, and the acquisition workforce leading to substantial benefits to small businesses, improved technology for federal agencies, and greater flexibility for acquisition professionals across government.

Polaris will also drive progress on important public policy objectives including the President’s Executive Order 13985 On Advancing Racial Equity and Support for Underserved Communities Through the Federal Government. Initial priorities on Polaris will be the creation of pools to accommodate set-asides for small businesses; women-owned small businesses (WOSB); service-disabled, veteran-owned small businesses (SDVOSB), and businesses located in HUBZones to help deliver on their mission and meet their socio-economic goals.

We are developing a dynamic contracting program that provides flexibility to establish additional industry partner pools on Polaris in the future as we continue to assess technology trends and changing customer needs.

The resulting approach incorporates feedback from agencies and industry, and includes ways to ensure that the technology remains relevant and the latest acquisition policies are used.

Through Polaris, we will:

  • Establish a pre-qualified industrial base that government agencies can tap into with confidence and ease
  • Bring multiple socioeconomic categories onto one vehicle to provide agencies with convenient access to small disadvantaged IT service providers
  • Enable agencies to acquire state-of-the-art IT services in a compliant and cost-effective manner

The overarching strategy shaping our approach to Polaris includes:

  • Providing greater opportunities to small businesses by removing barriers to entry and providing additional training and engagement with industry
  • Supporting greater equity in government contracting
  • Connecting agencies with highly qualified technology providers
  • Improving ease of use for agencies, industry partners, and GSA employees

Key Polaris features that we’re aiming for:

  • Periodic refreshment of the industrial base through on-ramps
  • Access to emerging technologies
  • No-price awards with pricing negotiated at the task order level — to promote competition.
  • Inclusion of a technical refresh clause that can be triggered as needed to adapt to customer needs.
  • Support for IT modernization and emerging technologies capabilities by offering the latest in cloud offerings from storage services to quantum computing services
  • Catalog of service offerings
  • A maximum 10-year ordering period
  • No contract ceiling
  • Leverage the cloud business model for service offerings

Polaris will also include supply chain risk management (SCRM) and cybersecurity requirements similar to those that were included in the 8(a) STARS III GWAC.

Polaris will support GSA’s goals to help agencies reach their sustainability goals, reduce the environmental impact of the federal government, make the work environment more sustainable and environmentally friendly, and protect the environment by fostering markets for sustainable IT technologies and services.

Many of you have had questions about how teaming arrangements and joint ventures will work on Polaris. In a soon-to-be-released update to our draft solicitation, we’ll be including guidance on how joint ventures will be scored.

Navigating the Future

As we work to bring Polaris to market we have a very busy fall season lined up.

We’re working to release an updated draft of the Polaris solicitation for sections L and M and the scorecard, and we’ll welcome your feedback on those. Keep an eye on our Small Business GWAC Community of Interest page for that.

We met with our VETS 2 Industry Partners about the inclusion of an SDVOSB pool on Polaris and we’re actively gathering their input.

GSA’s Office of Small and Disadvantaged Business Utilization is hosting an event on Wednesday, September 29th: Small Business Works 2021: Level Up & Network Series. Be sure to catch it.

We’re also planning a focused GSA Polaris Industry Forum for Wednesday, October 20th, and we encourage our small business industry partners to attend. Register Here

Finally, we’re aiming for the final Polaris solicitation to be released in short order with a pre-proposal conference to follow shortly thereafter.

I’m so proud of the work that our team has done on our small business GWACs, and we really couldn’t be more excited for what the future holds. Stay tuned to our Small Business GWAC Community of Interest page on GSA Interact for the latest updates.


Posted on

GSA’s Enterprise Infrastructure Solutions Instills Cybersecurity Confidence

On May 12, the White House issued the Executive Order on Improving the Nation’s Cybersecurity. This EO underlines the fundamental problem of how cybersecurity weaknesses leave critical infrastructure open to debilitating attacks. It also outlines what government agencies must do to improve their collective defensive posture, reduce risk, improve visibility and secure their infrastructure.

GSA’s Information Technology Category (ITC) tracks cybersecurity trends and is involved in conversations with industry experts on this topic. We incorporate the EO’s technological goals in our contract solutions, like Enterprise Infrastructure Solutions Contract, or EIS.

When it comes to network security, Zero-Trust Architecture (ZTA) is the gold standard. We even published a Zero Trust Architecture Buyer’s Guide to help agencies build toward it. EIS is featured prominently in the guide, because it offers baked-in security “building blocks” to create customizable solutions.

Managed Security Services

The EIS Managed Security Service (MSS) is a comprehensive service that protects an agency’s information technology assets—hardware devices, network, software, and information—from malicious attacks. It includes capabilities such as authentication, anti-virus, anti-malware/spyware, intrusion detection, and security event management. MSS comprises the following sub-services: Trusted Internet Connections Service (TICS), Managed Prevention Service (MPS), Vulnerability Scanning Service (VSS), and Incident Response Service (INRS).

Managed Network Services

The EIS Managed Network Service (MNS) enables an agency to outsource a portion or all of its network planning, design, implementation, maintenance, operations and customer service as a strategic move to improve IT services and lower costs.

Software Defined – Wide Area Network (SD-WAN) Services

SD-WAN services provide significant benefits by giving agencies central security management and visibility, the ability to segment networks where security policies can be tailored per application and data type, and identity-based user access.

Managed Trusted Internet Protocol Services (MTIPS)

MTIPS version 2.2 provides security for all external connections to public Internet, Extranet, and Cloud Service Providers. As agencies look to implement the Cybersecurity and Infrastructure Security Agency (CISA) TIC 3.0 guidance, MTIPS may be complemented with additional EIS services to achieve the updated security capabilities of a TIC 3.0 Traditional TIC solution.

FedRAMP Authorized Software-as-a-Service (SaaS) Tools

SaaS gives an agency access to applications hosted in the cloud. The provider manages the security, availability, and performance of the applications as part of their service. Using SaaS allows an agency to reduce the time, expense, and risk associated with the installation and maintenance of software on agency computers. EIS SaaS meets all federally required security standards for Cloud services.

EIS delivers solutions to agencies that will meet CISA’s latest Trusted Internet Connections (TIC) 3.0 guidance and ZTA requirements which include the Core Zero Trust Logical Components described in the National Institute of Standards and Technology (NIST) Special Publication 800-207. GSA continues to collaborate with CISA to provide guidance to agencies advancing legacy networks towards a zero trust architecture.

In the past decade, the typical federal agency network has evolved from being static with a known perimeter to mobile-friendly with nodes across the country. We are now regularly reminded that security solutions must correspondingly evolve to secure agency data and be able to ensure the safe transport of information to and from cloud applications, data centers, and remote users. If they don’t, the U.S. will continue to be vulnerable to malicious actors all over the world.

The Cybersecurity EO prioritizes “accelerated movement to secure cloud services; centralized and streamlined access to cybersecurity data to drive analytics for identifying and managing cybersecurity risks; and investment in both technology and personnel to match these modernization goals.” EIS already supports these by supplying SD-WAN services, 5th Generation (5G) telecommunications technology, Internet of Things (IoT) offerings, and Cloud-based security solutions.

Using EIS to buy IT infrastructure ensures a greater degree of consistency in the government’s telecommunications and network infrastructure services. It also consolidates the government’s purchasing power, driving lower prices on products and services that to satisfy complex security, flexibility, and visibility needs. EIS solutions offer the foundation needed to adapt to evolving threats and continue accomplishing your mission. The sooner agencies transition, the sooner they can take advantage of the secure solutions available on EIS. Accelerate your transition progress by Taking A.I.M. at EIS.

Posted on

Taking A.I.M. at EIS

Enterprise Infrastructure Solutions (EIS) transition

The transition to Enterprise Infrastructure Solutions (EIS) is one critical path for agencies to evolve to more modernized and secure IT infrastructures and away from legacy technologies that are vulnerable to security risks — a high priority for this Administration. With the President’s Executive Order on Improving the Nation’s Cybersecurity, it’s important to remember that the transition to EIS is not about shutting down expiring contracts; it’s ultimately about the safety, security, and sustainability of the federal government’s IT infrastructure.

The most recent EIS transition milestone came and went on March 31, when agencies were expected to have disconnected at least 50 percent of their services from the expiring Networx, Washington Interagency Telecommunications System (WITS) 3, and Local Service contracts.

While the data illustrates agencies are making progress, with 55% of the federal government’s inventory remaining to be disconnected, there is still much work to be done. Therefore, we urge our agency partners to take A.I.M. at EIS:

  • Assess their status and accelerate their progress
  • Disconnect & transition their Inventory
  • Mitigate risk to ensure mission operations continue

Assessing status and accelerating progress

Less than two years remain before the Networx, WITS 3, and Local Service contracts expire on May 31, 2023. Though the September 30, 2022 deadline for 100% disconnect from expiring contracts is a little over 15 months away, we want to remind agencies that a lack of transition progress could result in service disconnection much sooner. Please assess your progress against several important dates that are outlined in the revised Project Plan for Closeout of Transition and accelerate actions accordingly:

  • June 30, 2021 – Agencies that are not transitioning to EIS will have services disconnected. On this date, agencies for whom GSA has provided a report for a price-only fair opportunity decision, but have yet to award the task order, will also be disconnected.
  • August 31, 2021 – Agencies that have not awarded any EIS task orders for their solicitations will be disconnected.
  • September 30, 2021 – Agencies that have not awarded EIS task orders for all their solicitations will be disconnected.
  • October 1, 2021 – GSA will no longer accept or process any exception requests for the expiring contracts (Networx, WITS 3, and Local Service Agreements). All new services should be ordered from the EIS contracts or other viable contracts.
Enterprise Infrastructure Solutions Transition Timeline with remaining milestone dates and upcoming Closeout Phases for 2021 June 30, 2021. Agencies that are not transitioning to EIS will have services disconnected. On this date, agencies for whom GSA has provided a report for a price-only fair opportunity decision, but have yet to award the task order, will also be disconnected . August 31, 2021. Agencies that have not awarded any EIS task orders for their solicitations will be disconnected. September 30, 2021. Agencies that have not awarded EIS task orders for all their solicitations will be disconnected. October 1, 2021. GSA will no longer accept or process any exception requests for the expiring contracts (Networx, WITS 3, and Local Service Agreements). All new services should be ordered from the EIS contracts or other viable contracts.
Enterprise Infrastructure Solutions Transition Timeline with remaining milestone dates and upcoming closeout phases for 2021

The next major milestone for EIS transition is on March 31, 2022, which calls for 90% of services disconnected from expiring contracts. With less than 12 months to go, we urge agencies to accelerate progress, so as not to fall further behind.

Inventory: enhanced focus on disconnecting and transitioning inventory to EIS

Government-wide, we are behind the EIS curve. 11 of 17 large agencies and 15 of 25 medium-size agencies have yet to disconnect even 50 percent of their services as of March 31, 2021. Ultimately, missing transition milestones and continued reliance on expiring contracts risks disruption of critical services delivered to the public.

Mitigating risk to ensure mission operations continue

The more agencies fall behind the established milestones, the greater the risk to their mission. This not only leaves less time for transition-related activities ahead of the September 2022 milestone, but it will also increase the potential that agencies may be “stuck” waiting for disconnect and transition services to be rendered. In particular, agencies that delay their EIS contractor selection for replacement services may find themselves “in line” behind those that have already chosen a contractor and made transition progress. This further slows progress for disconnecting services from the expiring contracts and connecting new services.

The extended contracts expire on May 31, 2023 and there will be no extensions. We invite our agency partners to ask themselves “Will we complete transition on time?”. If your agency will not complete transition on time, contingency planning must start now.

The time for EIS transition action is now. Regardless if your agency is in the acquisition or implementation phase, know that GSA wants to actively support agency transitions. If your agency is struggling, GSA can provide services such as:

  • An inventory of complete services that need to be transitioned, including custom reports for your agency
  • Technical, acquisition, and ordering assistance, plus automated tools to directly assist agencies with expediting EIS task orders
  • GSA in-scope reviews of agency solicitations
  • Regular outreach to agencies’ Integrated Transition Teams to monitor transition progress and provide guidance

If your agency needs help with transition, please contact the IT Customer Service Center at 855-482-4348, or send an email to ITCSC@gsa.gov. We encourage you to reach out to your agency leadership. Include Chief Information, Acquisition, and Financial Officers in conversations on EIS transition, financials, and risk.

Posted on

Zero Trust Architecture: Acquisition and Adoption

What is Zero Trust Architecture (ZTA)?

Zero Trust is not a technology, but an approach to cybersecurity. It assumes all cyber networks and traffic are hostile in nature, and that any implicit trust in users should be eliminated. Now, more than ever, Zero Trust concepts are becoming increasingly important to an agency’s IT security posture as we see an increase in cyber attacks.

Zero Trust Architecture (ZTA) is a cybersecurity strategy that employs narrow and dynamic network defenses where every action, and use of resources is questioned, and where users are given the minimum levels of access to information needed to do their jobs.

To fully implement ZTA, organizations need to focus on the integration and implementation of a range of tactics and technologies. We can no longer rely on the concept of “trust, but verify”. Instead, agencies must verify, re-verify, and continue re-verifying with added layers of cybersecurity to establish true ZTA.

Why is ZTA important now?

Recent sophisticated cyber attacks and the shift to remote/virtual work environments highlight the importance of focusing on cybersecurity. The recent Sunburst and Colonial Pipeline cyber attacks exposed vulnerabilities in government and private sector computer systems. These attacks are a stark reminder that a weakness anywhere is a weakness everywhere. Furthermore, as organizations move to a mix of cloud-based, on-premises, and hybrid network models, traditional perimeter-focused network defenses can no longer protect an organization’s information communication technology assets. To keep pace with today’s dynamic and increasingly sophisticated cyber threat environment, government agencies must move quickly to modernize their cybersecurity capabilities and accelerate towards the adoption of ZTA.

In 2020, the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207, Zero Trust Architecture was released to provide agencies with guidance and detailed recommendations to improve their security posture using the core principles of ZTA. More recently, Executive Order 14028 “Improving the Nation’s Cybersecurity” requires all Federal agencies to develop a plan to implement ZTA in an effort to modernize and strengthen cybersecurity standards and detection.

What can agencies do to embrace ZTA?

Although there is no single end-to-end, comprehensive Zero Trust network solution, movement towards a Zero Trust security posture does not require agencies to rip and replace existing cybersecurity tools, hardware, or software products. Rather, agencies can make incremental steps to “re-tool” existing products to adhere to Zero Trust principles and supplement with GSA-offered products, services, and solutions to achieve ZTA.

GSA created a Zero Trust Architecture Buyer’s Guide for acquisition, network architect, and cybersecurity professionals who are seeking to implement ZTA. The guide is a roadmap to ZTA and provides helpful concepts and best practices. Zero Trust security models currently range between five and seven pillars. For the purposes of facilitating an acquisition-based perspective, GSA chose to represent a combination of eight unique pillars that agencies should consider when implementing a robust and efficient Zero Trust security model.

Zero Trust Architecture Pillars-User, Device, Network, Infrastructure, Application, Data, Visibility and Analytics, Orchestration and Automation

Getting to Zero Trust is a journey. Moving to ZTA will take time, and agencies will be at different starting points as they implement a Zero Trust strategy. When evaluating a ZTA solution, agencies should consider how well the product or service addresses these eight pillars and to what extent.

Zero Trust Pillars

PillarDescription
UserInvolves focus on user identification, authentication, and access control policies which verify user attempts connecting to the network using dynamic and contextual data analysis.
DevicePerforms “system of record” validation of user-controlled and autonomous devices to determine acceptable cybersecurity posture and trustworthiness.
NetworkIsolates sensitive resources from being accessed by unauthorized people or things by dynamically defining network access, deploying micro-segmentation techniques, and control network flows while encrypting end-to-end traffic.
InfrastructureEnsures systems and services within a workload are protected against unintended and unauthorized access, and potential vulnerabilities.
ApplicationIntegrates user, device, and data components to secure access at the application layer. Security wraps each workload and compute container to prevent data collection, unauthorized access or tampering with sensitive applications and services.
DataInvolves focus on securing and enforcing access to data based on the data’s categorization and classification to isolate the data from everyone except those that need access.
Visibility and AnalyticsProvides insight into user and system behavior analytics by observing real-time communications between all Zero Trust components.
Orchestration and AutomationAutomates security and network operational processes across the ZTA by orchestrating functions between similar and disparate security systems and applications.
Zero Trust Pillars

How can GSA help?

There are many elements of a Zero Trust solution that crosscut and incorporate GSA contract offerings. The information provided in the Zero Trust Architecture Buyer’s Guide can help agencies mature their Zero Trust implementation plans.

There are multiple GSA resources that support Zero Trust efforts, like the Highly Adaptive Cybersecurity Services (HACS) Special Item Number (SIN) which provides access to vendors who have passed an oral technical evaluation for cybersecurity services, making it easier for agencies to find quality vendors.

The Continuous Diagnostics and Mitigation (CDM) Tools SIN provides access to cybersecurity products included on the Department of Homeland Security Cybersecurity & Infrastructure Security Agency’s Approved Products List. Agencies can use these and other comprehensive GSA solutions to support the design and deployment of architectures that follow the tenets of Zero Trust.

Posted on

Think Cloud, Think GSA

Think Cloud, Think GSA FAST 2021 promo image - event July 15

We know you use cloud computing for more than just migration and storage. Some agencies need a trusted consultant to plan long-term strategy. Others are ready to build their own applications and deploy next-generation technology. GSA cloud experts want to alleviate your acquisition pain and answer your questions directly. To that end, the Information Technology Category and 3 other GSA offices are offering a guided tour of GSA’s cloud portfolio at our “Think Cloud, Think GSA” event from 1-3 PM Eastern on Thursday, July 15.

Our cloud experts will:

  • Answer your cloud technical and acquisition questions
  • Explore GSA cloud products and services offered by multiple GSA offices
  • Explain the buying options available to help agencies move through their cloud adoption journey.

Here are a few session teasers:

The Technology Transformation Services’ (TTS) Cloud Center of Excellence helps your agency innovate with embedded, on hand expertise. Understand how the Cloud Center of Excellence empowers agencies to undertake IT modernization and how their acquisition, security and technology teams are used as an engine of organizational change.

The Information Technology Category’s (ITC) Cloud Acquisition Team gives those agencies that know what cloud products and services they want the information needed to acquire them. Hear about the Cloud Information Center, the pre-competed Multiple Award Schedule Cloud SIN, and more.

The Technology Transformation Services’ (TTS) Cloud.gov supports government agencies in getting to the cloud quickly, securely, and in a compliant manner. Three Cloud.gov experts will cover how their Platform-as-a-Service offering fits any step of a customer’s journey to the cloud, and how they are just a simple InterAgency Agreement away.

The Assisted Acquisition Services’ (AAS) FedSIM office works with mature organizations that have complex acquisition needs. Hear from the director Chris Hamm on how this white glove services span acquisition, financial, and project management for the full acquisition life cycle.

Think Cloud, Think GSA event promo image

Sonny Hashmi, GSA Federal Acquisition Service Commissioner, will give an opening keynote about how cloud policy and technology has progressed over the past decade. Sam Navarro, Director of the Customer Strategic Solutions Division, will act as Master of Ceremonies.

This event is open to government and industry. Participants are eligible to earn 2 Continuous Learning Points (CLPs). Registration is free and open to all.

Register and reserve your virtual seat today.

Posted on

VETS 2 Provides IT Services Core Capabilities

GSA’s Veteran Technology Services 2 (VETS 2) Governmentwide Acquisition Contract (GWAC) for IT Services provides critical IT solutions with comprehensive core capabilities to meet diverse agency IT requirements, including new and emerging technologies.

We recently conducted a survey of our 69 highly qualified VETS 2 industry partners to better understand their core capabilities and to highlight their strengths. This survey provides great insights into how VETS can help agencies — and we wanted to share.

We received responses from 97 percent of VETS 2 contractors and we’ve depicted those results below in graph format. Here are some highlights:

The top four types of IT Services they provide are:

  • IT Operations and Maintenance
  • Software Development
  • Information and Communications Technology
  • IT Security

VETS 2 contractors have successfully performed a variety of IT services for the government, the top five areas of past performance include:

  • IT Service Desk
  • Cyber Security
  • Agile Software Development
  • Cloud Computing
  • CyberOps

I also want to point out that 90 percent of VETS 2 industry partners hold a secret or top secret security clearance and 84 percent have an audited and approved cost accounting system. This means that no matter what your IT requirements are, our VETS 2 industry partners are well positioned to help.

VETS 2 is recognized by the Office of Management and Budget as Best-in-Class and is the only GWAC set-aside exclusively for Service-Disabled, Veteran-Owned Small Businesses. It’s the ideal vehicle to meet your IT mission needs.

Curious if VETS 2 is right for you? We’re happy to review your scope of work (SOW). This is a free, no obligation service and we’ll provide a written opinion within 5-7 business days. Request a SOW review here.

Visit our website to learn more about VETS 2.

Please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.

To get updates for this blog, please sign up on the right-hand side of the page where it says Sign up for Blog Updates.

Posted on

The FedRelay Transition will Preserve Services and Improve Accessibility

To ensure FedRelay customers experience improved access, enhanced service and no loss of coverage, GSA is working with the Federal Communications Commission (FCC) to transition users to the FCC-administered Telecommunications Relay Service (TRS) and GSA’s Multiple Award Schedule (MAS).

Like FedRelay, TRS offers a suite of telecommunications relay services that help individuals with hearing or speech disabilities communicate with government agencies and conduct official business.

GSA initiated the required market research to prepare for the next generation of FedRelay and determined that for the majority of relay services, TRS would deliver the greatest value while enhancing services provided.

TRS comes with the additional benefit of no cost to agencies. The FedRelay services that are not offered by TRS, Relay Conference Captioning and Video Remote Interpreting, are already available at lower pricing on the GSA MAS, Language Services SIN 541930.

The current FedRelay contract ends on May 15, 2021. Agencies who have current task orders can extend them an additional six months until November 15, 2021. To prepare for transition, agencies should ensure that their FedRelay accounts are current and address any outstanding invoices. Transition updates will be posted on the GSA FedRelay webpage.

Customers with questions and those who are ready to begin the transition process should contact the GSA FedRelay Program Office at federalrelayservices@gsa.gov.

Please follow us on Twitter @GSA_ITC and LinkedIn to join our ongoing conversations about government IT.

To get updates for this blog, please sign up on the right-hand side of the page where it says Sign up for Blog Updates.