The General Services Administration (GSA) is working on consolidating the certification framework for cloud service providers who are new to the FedRAMP Program. Right now, a full traditional security assessment and review is expensive and cumbersome for the government and creates barriers for cloud service providers looking to get FedRAMP certified. The goal is to reduce the initial review burden with consolidated rules that are anticipated to be published by the end of June 2026, and retire the FedRAMP Ready designation program. If you offer cloud services and are currently doing business with the federal government, or plan to in the future, read on to learn more about these changes.

This probably isn't the first time you're hearing about Multiple Award Schedule (MAS) Solicitation Refresh #31, but it might be the first time you're hearing of GSA's latest updates to the Refresh since the timeline was extended to March/April. GSA is planning significant changes with Refresh #31, including making Transactional Data Reporting (TDR) mandatory for all GSA MAS contractors, and proposing strict AI provisions. This is a big move for the MAS Program because Commercial Sales Practices (CSP) and reporting will no longer be a part of the Solicitation, and contractors may have to rethink the way they use AI. GSA also plans to make several other updates surrounding the Startup Springboard Program, clause provisions, and specific Large Categories. Since GSA is giving industry a brief opportunity to comment on the AI provisions, it's important you know what's to come in the next few months.

It's a great time to be in the public sector if you offer professional services. Earlier this year, GSA opened Phase II of their OASIS+ contract vehicle and expanded the scope with 5 new domains. There is currently no deadline for submission or limit on contract awards, so we're encouraging companies to get their foot in the door now. If you offer non-IT professional services, this vehicle might be for you. Let's review what OASIS+ is and how your business may be able to benefit from the contract.

Earlier this year, GSA released cybersecurity requirements that mimic the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC). The “IT Security Procedural Guide”, or more formally known as CIO-IT Security 21-112, establishes a new framework of security requirements and privacy controls for contractors who deal with Controlled Unclassified Information (CUI) in nonfederal systems. Since this requirement was rolled out quickly and quietly without a formal announcement, some contractors may not be aware of the change. You may be wondering if this applies to your company or affects your contract. We’ll cover everything you need to know below.

If you’ve made the decision to pursue a GSA Schedule contract, one of the first choices you will need to make is whether to go it alone or hire a GSA consultant to help. At first, your instinct might be to save money and handle it internally because you may have a sales or marketing team that deals with your commercial sales. However, it's important to remember that the government marketplace is a whole new world. The acquisition process is not easy or straightforward, and once you get your contract awarded, you have to manage it for up 20 years.

A key part of winning business in any market is drafting a strong and effective proposal. They may not all look the same, or are sometimes called by different names across industries, but the goal is always to win the reader over. But how exactly do you accomplish that? Requests for Proposals (RFPs) are a key part of your government contract, and while there's an entire rulebook on how to reply to them (the Federal Acquisition Regulation), there are some unspoken rules contractors should follow.