ABOUT GTSC

I always start out any discussion of cybersecurity by emphasizing the context of the problem.  In our increasingly hyper-connected world, cyber risks affect us all – governments, private sector organizations, and individuals.  Cybersecurity events have become commonplace, almost daily occurrences, and with the advent of the “internet of things,” they are only going to increase in frequency and magnitude.  It is a shared problem.  And it demands a shared solution.  We have an obligation to take actions in our personal and professional lives to help provide for our personal, national and economic security.  Changing how the federal government buys things using our tax dollars is an important part of the solution.

Last week DoD and GSA released a report that provides six strategic acquisition reforms to improve cybersecurity.  I’m pleased that the recommendations have been well received by the federal acquisition community.   In my opinion, the report has been well received because it is a community product.  The recommendations reflect the views and expertise of a diverse set of stakeholders from sole proprietors and individual citizens to multinational corporations and government agencies.  The report does a decent job of articulating what needs to be done; now the hard work of figuring out how it gets done is in front of us.

As a threshold matter, it’s important to know that the order of the recommendations in the report is not indicative of their relative importance or the sequence of implementation.  The most important recommendation is actually number four.  Why is number four most important?  Because the other recommendations can’t be fully implemented until number four is.  For example, recommendation number one suggests including new “cybersecurity hygiene” requirements for appropriate contracts.  However, we won’t know which contracts are appropriate until the risk management strategy of number four is at least partially developed.  I’ll explain below.

Recommendation number four is titled:  “Institute a Federal Acquisition Cyber Risk Management Strategy.”

The goal of this recommendation is to develop a repeatable, scalable process for addressing cyber risk in federal acquisitions based on (1) the risk inherent to the product or service being purchased, and (2) the risk tolerance of the end user.

The first step is to develop a consistent method to measure cyber risk in the things the government buys.  Once we specifically identify which types of acquisitions present cyber risk, we can decide which types are “appropriate.”  From National Security Systems to paper clips – a primary question here is, which types of buying do or don’t present cyber risk?

Because we can’t possibly address all the types of acquisition at once, the next step is to prioritize the types of federal acquisition by risk so we can identify the right starting point.  The prioritization should probably consider cyber risk, mission-criticality of the function supported by the type of acquisition, and the amount of money spent on the type of acquisition annually, among other things.  Which other things should this prioritization consider?

After the prioritization is complete, starting with the highest risk type of buying, develop acquisition-cybersecurity “overlays” applicable to all buys of that type.  The overlays will include both procurement and information security practices – two very different and arcane disciplines.  Which security controls from NIST SP 800-53 revision 4 should apply to a type of acquisition?  Which acquisition practices should apply?  When should the government not use lowest-price-technically-acceptable source selection?

The DoD-GSA report gives us a good strategy, and it provides a solid frame of reference, but as the old saying goes – the devil is in the details.  Nothing could be truer about the next steps here.

The government has committed to continuing the collaborative process used to develop the recommendations as it develops the implementation plan.  In the next few weeks, the agencies will publish a request for comment on a draft plan for implementing the recommendations.  The draft plan will propose specific actions to accomplish the recommendations, starting with the cyber risk management strategy.

So, stay engaged.  And when the request for comment is published, do your part to help solve one of the most pressing issues of our time by submitting your suggestions.

By Contributing Author:  Emile Monette

Emile Monette is a recognized authority in the legal and operational aspects of public procurement, cybersecurity supply chain risk, and supply chain sustainability.  His background includes domestic, international, and U.S. military experience investigating, negotiating, and managing multimillion-dollar contracts.  Emile is a fifteen-year veteran of procurement law and policy development, and he has served in various positions in the legislative and executive branches of the federal government.

The final report is perhaps most notable as another step toward an era where most every government contractor must satisfy baseline cybersecurity requirements. While the final report does not provide explicit guidance on the details of creating such a new procurement environment, in light of recent, imminent and forthcoming government activity, including the final rule imposing cybersecurity and reporting obligations on DoD contractors (issued November 18, 2013 and summarized here), the upcoming final cybersecurity framework of the National Institute of Standards and Technology (NIST) (to be released in mid-February), and the forthcoming final rule governing the safeguarding of government contractor information systems (likely finalized next year), we view this final report as a bellwether. Government contractors who ignore the final report and the course it has set do so at their own peril.

Cybersecurity issues will increasingly affect agency standard setting, coverage issues and incentives, government audits and investigations, security breach litigation, and other business drivers. Government contractors and other companies that handle government information or supply components that could be compromised electronically must begin, to the extent they have not already done so, to think both strategically and pragmatically about developing an integrated approach to these cybersecurity issues.

Background

On February 12, 2013, President Obama issued EO 13636 – Improving Critical Infrastructure Cybersecurity. Section 8(e) mandated that the Working Group, in consultation with the Department of Homeland Security (DHS) and the Federal Acquisition Regulatory (FAR) Council, “make recommendations to the President . . . on the feasibility, security benefits, and relative merits of incorporating security standards into acquisition planning and contract administration.” Section 8(e) also directed the Working Group to “address what steps can be taken to harmonize and make consistent existing procurement requirements related to cybersecurity.”

On May 13, 2013, the Working Group published a request for information (RFI), inviting public comment on the appropriate cybersecurity measures and parameters for federal procurements (summarized here). The Working Group also consulted with representatives from the DoD, GSA, DHS, FAR Council, the Office of Federal Procurement Policy, NIST, and others before issuing the final report.

Working Group Recommendations

The final report makes six recommendations, including that the federal government and/or contractors, as appropriate, should:

(1) institute baseline cybersecurity requirements as a condition of contract award for appropriate acquisitions;

(2) address cybersecurity in relevant training;

(3) develop common cybersecurity definitions for federal acquisitions;

(4) institute a federal acquisition cyber risk management strategy;

(5) include a requirement to purchase from original equipment or component manufacturers (OEM), their authorized resellers, or other trusted sources, when available, for appropriate acquisitions; and

(6) increase government accountability for cyber risk management.

For contractors, the most helpful recommendations ask the government to clarify, with more specificity, the standards to which contractors will be held accountable. For example, the first recommendation correctly observes that, “[o]ften, cybersecurity requirements are expressed in terms of compliance with broadly stated standards and are included in a section of the contract that is not part of the technical description of the product or service the government seeks to acquire.” This, the report concedes, “leaves too much ambiguity as to which cybersecurity measures are actually required in the delivered item.” Accordingly, the report recommends expressing baseline cybersecurity requirements as part of the acquisition’s technical requirements and including performance measures to ensure the baseline is maintained and risks are identified. The final report also recommends common cybersecurity definitions, which if adopted would dramatically advance anxiety about contractors’ and the government’s current and near-future cybersecurity obligations.

Though the recommendations are instructive, the final report does not actually mandate specific baseline requirements or propose common cybersecurity definitions. Nor does it propose a cyber risk management strategy or otherwise attempt to identify the acquisitions in which baseline requirements or OEM limitations are “appropriate.” Instead, the final report “intends” that others will harmonize these recommendations with ongoing rulemakings, cybersecurity standards, and statutory frameworks. In short: stay tuned.

Takeaways

First and foremost, change is coming. Although the final report recommendations are directed more toward government program managers and acquisition decision makers than industry, the harmonization of such recommendations with recent and forthcoming regulations, mandatory contract provisions, and other statutory requirements and protections will affect the industry directly and significantly.

Other critical points for government contractors to consider as the final report’s recommendations are implemented include:

The final report is a clear signal that mandatory baseline standards, training protocols, and other risk-based requirements are on the horizon. Those standards will likely be based on the NIST framework or, in specialized areas, even stricter protocols. Government contractors and other companies that handle government information must implement an integrated strategy that mitigates the risks associated with these cybersecurity issues, and where viable, the opportunities that these changes might create.

By Contributing Authors:   Brian Finch, Justin Chiarodo, and Daniel Broderick from GTSC Strategic Partner Dickstein Shapiro

Brian Finch, a partner in Dickstein Shapiro’s Washington, DC office, is head of the firm’s Global Security Practice. Named by Washingtonian magazine in 2011 as one of the top 40 federal lobbyists under the age of 40, Brian is a recognized authority on global security matters who counsels clients on regulatory and government affairs issues involving the Department of Homeland Security, Congress, the Department of Defense, and other federal agencies.  Dickstein Shapiro is a Strategic Partner of the Government Technology & Services Coalition.   You can reach Brian at finch@dicksteinshapiro.com (202)420-4823. 

Justin Chiarodo represents clients in all aspects of federal, state, and local procurement law. Named by Law360 in 2013 as a “Rising Star” in Government Contracts, Justin has extensive experience in government contracts litigation, compliance, and regulatory matters, with particular expertise in the defense, health care, technology, and professional services sectors.

Daniel Broderick is a Washington, DC-based associate in Dickstein Shapiro’s Energy Practice. He focuses on regulatory and project development matters affecting clients in the electricity industry, including electric market design, municipalization, compliance, certification, and power purchase agreements. 

After years of practice and experience, the IACCM has brought together best practices in government contracting from around the globe. Paired with the former procurement officer of the U.S. Department of Homeland Security, this session will combine what best practices can be applied toward contracting with DHS and the Defense Department.

Guest Speakers:

Tim Cummins
President & CEO
IACCM
Strategic Partner, GTSC

Tom Essig
BACK BY POPULAR DEMAND!
Former Chief Procurement Officer, Department of Homeland Security
Owner, TWE, LLC
Strategic Advisor, GTSC

REGISTER

Mr. Robert J. Carey, Principal Deputy Chief Information Officer, U.S. Department of Defense

Mr. Robert J. Carey serves as the Department of Defense Principal Deputy Chief Information Officer.  Selected to this position in October 2010, his main focus is to help lead the consolidation and standardization of the Defense information technology enterprise while strengthening its cybersecurity posture and the enterprise architecture.  His additional focus is to align, strengthen and manage the office of the DoD Chief Information Officer to have it better serve the Department’s mission and help lead the IT/Cyber workforce into the 21st century.

From November 2006 to September 2010, he served as the fifth Department of the Navy (DON) Chief Information Officer (CIO) where he championed transformation, enterprise services, the use of the internet, and information security.  Mr. Carey joined the staff of the DON CIO in February 2000, serving as the DON CIO eBusiness Team Leader through June 2003.  During this period, he also served as the Director of the DON Smart Card Office from February through September 2001.  Mr. Carey entered the Senior Executive Service in June 2003 as the DON Deputy Chief Information Officer and was responsible for leading the DON CIO staff to achieve IM/IT enterprise integration across the Navy & Marine Corps.

Mr. Carey’s Federal service began with the U.S. Army at the Aberdeen Proving Ground in October 1982, where he worked as a Test Director evaluating small arms, automatic weapons and ammunition.  He began his service with the Department of the Navy in February 1985 with the Naval Sea Systems Command.  He worked in the Anti-Submarine/Undersea Warfare domain where he served in a variety of engineering and leadership positions.

Mr. Carey earned a BS in Engineering in 1982 from the University of South Carolina and a Master of Engineering Management from the George Washington University in 1995.  He has been awarded the Department of the Navy Distinguished Civilian Service Award (twice) as well as the Superior and Meritorious Civilian Service Awards.  He received the prestigious Federal 100 Award in 2006, 2008, and 2009, recognizing his significant contributions to Federal information technology.  He was selected to the InformationWeek Top 50 Government CIOs in 2009, 2010, and 2011.  Mr. Carey was named the Defense Executive of the Year for 2009 by Government Computer News, and he also received the prestigious Association for Federal Information Resources Management (AFFIRM) Executive Leadership Award – Defense for 2011.

A native of West Chester, PA, Mr. Carey is an active member of the United States Navy Reserve and currently holds the rank of CAPTAIN in the Civil Engineer Corps.  He was recalled to active duty for Operation Desert Shield/Storm and Operation Iraqi Freedom where, in 2006-2007, he served in the Al Anbar province with I Marine Expeditionary Force.