New SINs under Schedule 70

Recently the President announced his new Cybersecurity National Action Plan (CNAP), the GSA is supporting this plan by adding four new Highly Adaptive Cybersecurity Services SINs. The following services will be included: penetration testing, incident response, cyber hunt and risk and vulnerability assessment.

Each SIN added to GSA has it’s own specific purpose and is designed to work together with other new cybersecurity and preexisting schedule 70 SINs to propose a full solution.

Here’s a quick description of the proposed SIN:

Penetration Testing (132-45A) is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

Incident Response(132-45B)  services help organizations impacted by a Cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.

Cyber Hunt (132-45C) activities are responses to crisis or urgent situations within the pertinent domain to mitigate immediate and potential threats

Risk and Vulnerability Assessments (132-45D) conduct assessments of threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations

One major GSA related change for adding cybersecurity your GSA schedule is SCP-FSS-004 within the solicitation document which required an Oral Technical Evaluation for offers submitting under those SINs. The Technical Evaluation Board will be an unclassified level discussion where your company will need to show their expertise in the subject matter.

Based on CNAP, over $19 billion dollars will be invested into cybersecurity as part of the President’s FY17 budget increasing more that 35%. With cybersecurity threats constantly looming and the world moving more and more into cyberspace, the government is recognizing the importance of security. 

Government Cyber-Safety at Risk

The government seems to be consistently behind the curve of Information Technology purchasing. Is that because they are slow to adopt or do they have other difficulties in acquiring the newest and the best?

Being so far behind the curve of IT purchasing not only wastes taxpayers money, it also leaves the government extremely vulnerable to cyber-attacks. Earlier this year, millions of current and former federal workers’ data was stolen from the Office of Personnel Management. Prior to that attack, security clearance information was stolen from the same office. Software used by the government, sometimes even including infrastructure, is not able to repel determined cyber-attacks and hacks.

All these problems result from the government’s old and difficult ways of purchasing. The best and brightest of the information technology world, centered in Silicon Valley, are not open to working with the government due to purchasing methods that are old and outdated. Some government agencies will not even consider purchasing a product that has not been on the market for at least 2 years. With how quickly technology moves, this leaves the government vulnerable and open to attack.

Around June of 2015, the United States Navy signed a $9 million dollar contract to continue providing security patches for the Windows XP operating system, which had an original release date of October of 2001. Microsoft stopped support for the system in April 2014, but the US government is paying $9 million dollars to continue the support of the system. Reason being? The latest operating system, which is more secure for the government to use, has not been on the market long enough, according to government procurement rules, to be considered.

Looking forward, The National Defense Authorization Act for fiscal year 2016 is being debated in Congress at this time and within it are acquisition reform provisions; including  some procurement rules that could potential be repealed. At the top of that list is easing restrictions on Information Technology Purchases, which will entice startups and the “best and brightest” of Silicon Valley to help the government upgrade to better and, more importantly, safer hardware and software.

Sources:

http://www.nytimes.com/2015/07/10/us/office-of-personnel-management-hackers-got-data-of-millions.html?_r=0

https://www.congress.gov/bill/114th-congress/house-bill/1735?q=%7B%22search%22%3A%5B%22%5C%22hr1735%5C%22%22%5D%7D&resultIndex=1

http://fortune.com/2015/06/24/navy-microsoft-windows-xp/

Latest on the GSA and cyber assurance-

The General Services Administration has been working on several changes due to the latest increase in cyber security issues. The first being a Blanket Purchase Agreement (BPA) and the second being yet another addition to the Schedule 70 service offering.

The GSA is awarding a BPA for credit monitoring and identity protections services to address future issues, coming after the hack of The Office of Personnel Management’s security clearance database.

To also assist with future issues the GSA has release an RFI to determine if adding a SIN (Special Item Number) to Schedule 70 would be advantageous. It would cover hardware, software and services that fall under cyber assurance, virus detection, intrusion detection and network management.

You can take a look at the RFI that is currently on FedBizOpps here: https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&id=68e1e8b5cc17539fc9d4d8ee53189344

Responses to the RFI are currently due September 11, 2015 at 4PM EST.

If you need assistance with responding to the RFI or just have questions in general feel free to give us a call at 216-662-7044.