Skip to content Skip to left sidebar Skip to right sidebar Skip to footer

Tag: risk

Updating Govt Cloud Security

Cloud vendors will soon see standardized security liability language in all government contracts. This is partly due to agencies’ migration to the cloud being sped up once the pandemic hit and increased teleworking, making the need for cybersecurity assurances essential. (Nextgov, May 20, 2020)

Thomas Santucci, the director of the Data Center and Cloud Optimization Infrastructure Program Management Office at GSA, recently elaborated on the subject, “I think there is a need to update our [service level agreements] with the cloud providers and we’re actively working on that within [the General Services Administration]…. OMB has just stood up a [program management office] to work on a cloud SLA template for the federal government to be attached to every contract.” (ibid)

When referring to the pandemic, Santucci said, “Users are now remote rather than in a central building or campus. Agencies that are doing well are mostly in the cloud with little or no impact. Remote users do not need a [virtual private network] to gain access to their emails or files, collaboration products have significantly reduced file duplicates, and bandwidth consumption is between the home internet connection and the cloud. It’s a great success story.” (ibid)

Officials at the National Institute of Standards and Technology (NIST) believe moving to the cloud does not mean security is a “one and done” feature. There are many considerations that customers may be responsible for under contracts. Increased use of cloud services is not 100 percent secure.

Rep. Doris Matsui, D-California recently wrote to NIST Director Walter Copan, requesting NIST work to establish metrics to accompany their Cybersecurity Framework. The framework allows entities to implement security controls based on their needs. Matsui’s letter to Copan asked for ways to evaluate the security implications of those decisions. Matsui states, “with quantifiable measurement tools, cybersecurity strategies can be compared across industries and between entities. Metrics and measurements that facilitate comparisons and assess risk will be valuable for consumers, companies, and governments.” (ibid)

Wondering how your contract or upcoming proposal might be impacted by cloud migration and updated service level agreements? Give us a call.

One and Done! – Highly Adaptive Cybersecurity Services (HACS) update to Schedule 70

The field of cybersecurity has grown substantially since the initial launching of the four HACS in 2016. This growth has led GSA to restructure the original HACS SINS 132-45 (A-D) into a single HACS SIN, 132-45, with subcategories of cybersecurity services.

Federal agencies use large complex network and data systems to maintain and manage many forms of data and information, including High Value Assets that hold sensitive information critical to national and economic security. As a result, the proposed restructure will include the following full set of HACS SIN services:

• High-Value Asset Assessments

• Risk and Vulnerability Assessment (RVA)

• Incident Response

• Penetration Testing

• Cyber Hunt

The four current HACS SINs will be deleted from the solicitation and added as subcategories under the new HACS SIN 132-45.

Please feel free to give us a call at 301-913-5000 if you’d like to discuss your cybersecurity solutions for GSA Schedule 70.