With an increasing market in Information Technology (IT) and Information Systems, GSA wants to make sure your system is secure enough to support a potential threat. Even if you are not competing in the IT and Information Systems market, it’s important to make sure your entity and server is protected from cybersecurity attacks. We have seen an increase in harmful cyberattacks the past few years, and the federal government is focused now more than ever on improving the nation’s cybersecurity.
GSA Schedule contractors have several resources at their fingertips to make sure they are properly managing their networks from impending threats and remaining compliant with the government’s cybersecurity requirements. GSA maintains a formal program for information security management focused on FISMA requirements, protecting GSA IT resources, and supporting the GSA mission. We’ll cover these cybersecurity resources and programs so you can continue to practice good cyber hygiene.
GSA is required to provide quarterly and annual reports on its cybersecurity posture by FISMA. The Federal Information Security Management Act (FISMA) implements a mandatory set of processes and system controls designed to ensure the confidentiality, integrity, and availability of systems-related information. The FISMA was created in 2014, but recently, there has been discussions in the House of Representatives to make changes to and modernize the act. Although it is still in deliberation, it's something to keep your eye on.
This act applies to GSA federal employees and contractors who work within the cybersecurity framework. This program consists of policies, procedures, and processes to mitigate new threats and anticipate risks posed by new technologies. Implementing the FISMA risk management and goals process helps make sure your quarterly and annual cybersecurity reports are satisfactory but also helps protect your system for cyber-attacks.
The FISMA Risk Management metrics and goals are broken down into 5 categories:
1. IdentifyThe goal of the identify metrics section is to assist agencies with their inventory of the hardware and software systems and assets that connect their networks and develop an organizational understanding to manage cybersecurity risks to systems, assets, data, and capabilities.
2. Protect
The protect function supports agencies’ ability to limit the impact of potential cybersecurity events. This includes implementing appropriate safeguards to ensure delivery of critical services.
3. Detect
The ability to discover cybersecurity events in a timely manner.
4. Respond
The development and implementation of appropriate activities to take actions regarding a detected cybersecurity incident. The respond function supports the ability to contain the impact of a potential cybersecurity incident.
5. Recover
Ensures agencies/contractors develop and implement restoration capabilities and/or services that were impaired due to a cybersecurity event. This includes the development and implementation of appropriate activities to maintain plans for resilience for normal operations.
All new and existing GSA and contractors of information systems must undergo a security assessment and authorization at least every 3 years or whenever there is a significant change in the systems security posture. Part of the assessment is a FIPS 199 security impact categorization that determines how secure the system is. There are 3 security objectives for information and information systems as outlines by FIPS 199. The information system must maintain:
1. Confidentiality
2. Integrity
3. Availability
After assessing these three components, the FIPS Publication 199 defines 3 levels of potential impact on organizations or individuals should there be a breach of security (i.e., a loss of confidentiality, integrity, or availability):
1. The potential impact is LOW if: The loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organization operations, organizational assets, or individuals.
2. The potential impact is MODERATE if: The loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
3. The impact is HIGH if: The loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.
Even if you do not offer IT solutions and information systems to the government and you are not required to follow the programs above, it’s good practice to know what you can do to strengthen your network security, especially as many companies are still implementing telework orders.
GSA has a page on Cybersecurity Programs & Policy that will keep you updated on all their IT security programs, and initiatives to enhance the safety of the federal government’s networks. It also lists all the current policies and Executive Orders out about cybersecurity, and laws that affect contractors and agencies alike.
The Cybersecurity & Infrastructure Security Agency (CISA) has a page of useful cybersecurity resources to help you implement better hygiene and practices. This includes CISA’s telework resources, CISA’s cybersecurity hub, and CISA’s cyber essentials.
The National Cybersecurity Alliance has a page on how to stay safe online where you can report cybercrime, learn online safety basics, manage your privacy, and read about securing key accounts and devices.
These are just a few ways that GSA measures IT systems protection. GSA continues to address weaknesses identified in its IT security Plan of Action and Milestones. GSA annually provides security and privacy awareness training for over 16,000 employees and contractors. For more information on getting an IT contract or what it takes to have and maintain an IT contract under GSA, one of our consultants would be happy to help you. If you want to stay updated on all the new and upcoming GSA contractor requirements and learn about government contracting news and insights, you can check out our blog and subscribe to our monthly newsletter.