Selling cyber means understanding FITARA

The U.S. House of Representatives Committee on Oversight and Reform released its fifteenth  Federal Information Technology Acquisition Reform Act (FITARA) scorecard in December 2022. This latest scorecard introduced a new category for cyber security. 

With IT modernization as its goal, the committee grades agencies on implementing IT-focused legislation, namely provisions related to FITARA, the Modernizing Government Technology (MGT) Act and the Federal Information Security Modernization Act of 2014 (FISMA).

Agencies’ progress against enacting this key IT legislation has high visibility from the agency CIO to General Accounting Office (GAO) to Congress.

Technology vendors have an advantage over their competition if they can help customers show progress in measured categories. This is now particularly important for FITARA because agency self-assessment for compliance happens every spring.

Why FITARA matters for federal cyber security sales

Understanding the FITARA scorecard categories, researching your agency customers’ scores, and tracking how they may fall short can help you demonstrate exactly how you can help your customers raise their grades.

Awareness of your customer agency’s cyber security progress is critical because the FITARA scorecard now captures additional metrics. That means higher levels of visibility by Congress and transparency into CIO reporting structures. The new category for cyber security is one such metric. 

Unlike the current cyber measurement under the FISMA category that assigns a letter grade to agency progress, the new FITARA metric includes a percentage value for cyber security headway made by agencies.

Knowing where, why and how an agency ranks in this new category can provide insightful analysis and a better understanding of agency clients’ cyber challenges. It can also offer ideas about how your products and services can address suggested FITARA scorecard problems, drive solutions and raise scores in subsequent evaluations. 

Proposed changes from industry tie to a cyber executive order

In a 2022 report, the American Council for Technology-Industry Advisory Council (ACT-IAC) suggested changes to the FITARA scorecard. These recommendations help move away from oversight to a focus on real agency IT transformation, particularly in the area of zero trust-aligned cybersecurity.

These proposed changes would make it more likely to have the FITARA scorecard aligned with the Executive Order 14028, improving the nation’s cyber security.

ACT-IAC further recommended metrics that consider supply chain risk management maturity as a component of an agency’s grade.

Additional proposed changes included considering multifactor authentication, smart patching, asset management and response, zero-trust progress, and supply chain risk management maturity principles with an eventual weight prioritization based on identified risk areas. The report calls for measurements of where agencies are truly making changes that will meet the spirit of the legislation. 

So, what does this all mean for technology providers? Do your homework! 

• Understand your agency customer’s grade, and the data behind it to better align your cybersecurity solution.
• Know where your customer has gaps.
• Check data in FISMA reporting metrics, DHS’s Continuous Diagnostic and Mitigation Program, and as reported by the CIO or CISO of your client agency.

With that information, you’ll be better equipped to explain how your products and services can help mitigate risk and defend against threats. Key messaging for your solutions should focus on those benefits and how your products and services can help raise your customers’ cyber grades.

If you are in doubt on how to accomplish such tasks, consult with those who have expertise in such areas.

Tara Franzonello is legal services associate for immixGroup, the public sector business of Arrow Electronics. immixGroup delivers mission-driven results through innovative technology solutions for public sector IT. Visit www.immixgroup.com for more information.