Contract rules need IT security standards, official says
A defense official has recommended changing the Federal Acquisition Regulation to require contractors' IT products to meet minimum security standards.
A Defense Department official has recommended amending governmentwide acquisition rules to standardize security requirements for information technology purchases as agencies attempt to guard their computer systems against cyberattacks, according to a new report.
Gary Guissanie, DOD’s acting deputy assistant secretary for cyber, identity and information assurance, said contract language added to the Federal Acquisition Regulation (FAR) could ensure agencies’ new IT purchases include the settings specified in the Federal Desktop Core Configuration (FDCC), The FDCC is a White House initiative that gave agencies a minimum set of standards to protect their desktop and laptop computers from sophisticated hackers and other cyber threats.
New FAR language “would provide the appropriate coverage for a federal-wide IT contract issue,” Guissanie wrote to the Government Accountability Office regarding a report on the FDCC's accomplishments. The report was released April 12.
GAO officials said it was beyond their authority to say if new FAR rules are necessary or what they might entail. They did say DOD may want to pursue Guissanie’s recommendations with the Office of Management and Budget.
Regulators have not opened a case on the FDCC issue.
Related stories:
Agencies struggle with securing computers, GAO reports
DOD policy targets weak link in information security
Cybergeddon: Information security as a global concern
GAO reported eight agencies have incorporated language into their contracts and 13 have not, based on agency inspector general reports on other IT security requirements from fiscal 2009.
Responding to GAO, a few agency officials said they have added the contracting language to their new contracts. The Homeland Security, Housing and Urban Development and Labor departments include the clause about FDCC compliance. Other agencies, such as the Office of Personnel Management, and the Treasury and the Veterans Affairs departments, are finalizing their changes to acquisition policies.
GAO noted that some agencies didn’t include the clause in all IT contracts.
Meanwhile, GAO said agencies must push to secure their IT systems because of an increase in security incidents and steady advances in cyberattack technology.