GSA Proposes Changes to Cyber Security Rules for Federal Contractors

The General Services Administration (GSA) is planning to tighten up federal contractor cyber security requirements regarding sensitive non-classified data, according to a Federal Register Notice dated January 12. The rules would cover internal contractor systems, external contractor systems, cloud systems, and mobile systems.

Technically, the proposed rules aren’t “new.” The GSA wants to update the General Services Administration Acquisition Regulation (GSAR) to include existing GSA federal contractor cyber security requirements that did not previously go through the rulemaking process. This would allow the GSA the benefit of receiving public comments and ensure that the final rules are included in subsequent updates to the GSAR. There will be two public comment periods; the public can comment on the information security rules from April to June 2018 and on the incident response rules from August to October.

In addition to tightening up reporting requirements for federal contractor cyber security breaches, the new rules would require federal contractors to protect sensitive non-classified information in accordance with the Federal Information Security Modernization Act (FISMA) and the National Institute of Standards and Technology (NIST) requirements. Specifically, all federal contractors would be required to adhere to NIST SP 800–171 security requirements, just as DoD contractors are now required to do under DFARS, which went into effect on December 31. Applying NIST SP 800–171 requirements to all federal contractors would ensure uniformity in cyber security requirements and reporting.

Understanding NIST SP 800–171

NIST SP 800–171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, is 81 pages long and outlines 110 security controls across 14 categories, including:

* Access control
* Employee awareness and training
* Configuration management
* Risk assessment
* Security assessment
* Incident response

The crux of NIST SP 800–71 is that it applies to information that is unclassified yet sensitive. Under the GSA’s proposed rules, federal contractors that currently handle classified information will have to extend their security controls to cover additional systems, as DoD contractors were made to do to comply with DFARS. Contractors that do not currently handle classified data, on the other hand, will have a lot more work to do; some will need to completely rework their security controls to comply with NIST SP 800–171.

While these rules have not yet been enacted, there is every reason to believe that the GSA’s proposal will be approved in some form. Complying with a new, tougher set of standards will be challenging, but in the end, it will end up benefiting federal contractors. Right now, there is no uniformity to federal contractor cyber security standards; they are set by individual agencies. The GSA’s new standards will apply to every agency, which means that contractors who do business with multiple federal agencies will have to follow only one set of rules.

Is your organization compliant with all of the controls in NIST SP 800-171? Compliance can be complex, which is why it’s best to enlist the help of a professional IT audit and cyber security firm.