Contract rules need IT security standards, official says

A defense official recommends changing the Federal Acquisition Regulation to require contractors' IT products meet minimum security standards.

A Defense Department official has recommended amending governmentwide acquisition rules to standardize security requirements for information technology purchases as agencies attempt to guard their computer systems against cyberattacks, according to a new report.

Gary Guissanie, DOD’s acting deputy assistant secretary for cyber, identity and information assurance, said contract language added to the Federal Acquisition Regulation (FAR) could ensure agencies’ new IT purchases include the settings specified in the Federal Desktop Core Configuration (FDCC), The FDCC is a White House initiative that gave agencies a minimum set of standards to protect their desktop and laptop computers from sophisticated hackers and other cyber threats.

New FAR language “would provide the appropriate coverage for a federal-wide IT contract issue,” Guissanie wrote to the Government Accountability Office regarding a report on the FDCC's accomplishments. The report was released April 12.

GAO officials said it was beyond their authority to say if new FAR rules are necessary or what they might entail. They did say DOD may want to pursue Guissanie’s recommendations with the Office of Management and Budget.

Regulators have not opened a case on the FDCC issue.

Related stories:

Agencies struggle with securing computers, GAO reports

DOD policy targets weak link in information security 

Cybergeddon: Information security as a global concern 

In its report, GAO found agencies struggling to upgrade their computers to meet the basic security requirements in the FDCC initiative. According to the report, no agency required to meet the FDCC standards has fully done so. The initiative mandates including language in new contracts that requires companies' IT products comply with the FDCC's security standards.

GAO reported eight agencies have incorporated language into their contracts and 13 have not, based on agency inspector general reports on other IT security requirements from fiscal 2009.

Responding to GAO, a few agency officials said they have added the contracting language to their new contracts. The Homeland Security, Housing and Urban Development and Labor departments include the clause about FDCC compliance. Other agencies, such as the Office of Personnel Management, and the Treasury and the Veterans Affairs departments, are finalizing their changes to acquisition policies.

GAO noted that some agencies didn’t include the clause in all IT contracts.

Meanwhile, GAO said agencies must push to secure their IT systems because of an increase in security incidents and steady advances in cyberattack technology.

About the Author

Matthew Weigelt is a freelance journalist who writes about acquisition and procurement.


  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.