Contract rules need IT security standards, official says

A defense official recommends changing the Federal Acquisition Regulation to require contractors' IT products meet minimum security standards.

A Defense Department official has recommended amending governmentwide acquisition rules to standardize security requirements for information technology purchases as agencies attempt to guard their computer systems against cyberattacks, according to a new report.

Gary Guissanie, DOD’s acting deputy assistant secretary for cyber, identity and information assurance, said contract language added to the Federal Acquisition Regulation (FAR) could ensure agencies’ new IT purchases include the settings specified in the Federal Desktop Core Configuration (FDCC), The FDCC is a White House initiative that gave agencies a minimum set of standards to protect their desktop and laptop computers from sophisticated hackers and other cyber threats.

New FAR language “would provide the appropriate coverage for a federal-wide IT contract issue,” Guissanie wrote to the Government Accountability Office regarding a report on the FDCC's accomplishments. The report was released April 12.

GAO officials said it was beyond their authority to say if new FAR rules are necessary or what they might entail. They did say DOD may want to pursue Guissanie’s recommendations with the Office of Management and Budget.

Regulators have not opened a case on the FDCC issue.

Related stories:

Agencies struggle with securing computers, GAO reports

DOD policy targets weak link in information security 

Cybergeddon: Information security as a global concern 

In its report, GAO found agencies struggling to upgrade their computers to meet the basic security requirements in the FDCC initiative. According to the report, no agency required to meet the FDCC standards has fully done so. The initiative mandates including language in new contracts that requires companies' IT products comply with the FDCC's security standards.

GAO reported eight agencies have incorporated language into their contracts and 13 have not, based on agency inspector general reports on other IT security requirements from fiscal 2009.

Responding to GAO, a few agency officials said they have added the contracting language to their new contracts. The Homeland Security, Housing and Urban Development and Labor departments include the clause about FDCC compliance. Other agencies, such as the Office of Personnel Management, and the Treasury and the Veterans Affairs departments, are finalizing their changes to acquisition policies.

GAO noted that some agencies didn’t include the clause in all IT contracts.

Meanwhile, GAO said agencies must push to secure their IT systems because of an increase in security incidents and steady advances in cyberattack technology.

About the Author

Matthew Weigelt is a freelance journalist who writes about acquisition and procurement.


  • 2018 Fed 100

    The 2018 Federal 100

    This year's Fed 100 winners show just how much committed and talented individuals can accomplish in federal IT. Read their profiles to learn more!

  • Census
    How tech can save money for 2020 census

    Trump campaign taps census question as a fund-raising tool

    A fundraising email for the Trump-Pence reelection campaign is trying to get supporters behind a controversial change to the census -- asking respondents whether or not they are U.S. citizens.

  • Cloud
    DOD cloud

    DOD's latest cloud moves leave plenty of questions

    Speculation is still swirling about the implications of the draft solicitation for JEDI -- and about why a separate agreement for cloud-migration services was scaled back so dramatically.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.