U.S. General Services Administration Presentation to: ITIC Improving Cybersecurity through Acquisition Emile Monette Senior Advisor for Cybersecurity GSA Office of Mission Assurance January 29, 2014

2 Background: We Have a Problem  When the government purchases products or services with inadequate in-built “cybersecurity,” the risks created persist throughout the lifespan of the item purchased. The lasting effect of inadequate cybersecurity in acquired items is part of what makes acquisition reform so important to achieving cybersecurity and resiliency.  Currently, government and contractors use varied and nonstandard practices, which make it difficult to consistently manage and measure acquisition cyber risks across different organizations.  Meanwhile, due to the growing sophistication and complexity of ICT and the global ICT supply chains, federal agency information systems are increasingly at risk of compromise, and agencies need guidance to help manage ICT supply chain risks

Executive Order  On February 12, 2013, the President issued Executive Order (EO) directing Federal agencies to provide stronger protections for cyber-based systems that are critical to our national and economic security. Section 8(e) of the EO required GSA and DoD to: “… make recommendations to the President, … on the feasibility, security benefits, and relative merits of incorporating security standards into acquisition planning and contract administration”  GSA and DoD recommended six acquisition reforms: I.Institute Baseline Cybersecurity Requirements as a Condition of Contract Award for Appropriate Acquisitions II.Address Cybersecurity in Relevant Training III.Develop Common Cybersecurity Definitions for Federal Acquisitions IV.Institute a Federal Acquisition Cyber Risk Management Strategy V.Include a Requirement to Purchase from Original Equipment Manufacturers, Their Authorized Resellers, or Other “Trusted” Sources, Whenever Available, in Appropriate Acquisitions VI.Increase Government Accountability for Cyber Risk Management 3

White House Response to 8(e) Recommendations “DoD and GSA did an outstanding job engaging with public and private sector stakeholders to craft the report and provided realistic recommendations that will improve the security and resilience of the nation when implemented. Moving forward, we highlight that: –We view the core recommendation to be the focus on incorporating cyber risk management into enterprise acquisition risk management, built on “cybersecurity hygiene” baseline requirements for all IT contracts. –DoD and GSA must now move quickly to provide an implementation plan that includes milestones and specific actions to ensure integration with the various related activities like supply chain threat assessments and anti-counterfeiting. –DoD and GSA should ensure the highest level of senior leadership endorsement, accountability, and sustained commitment to implementing the recommendations through near and long term action. This should be communicated clearly to the Federal workforce, government contractors, and the oversight and legislative communities.” 4

8(e) Recommendations & Potential Impact RecommendationPotential Impact I. Institute Baseline Cybersecurity Requirements as a Condition of Contract Award for Appropriate Acquisitions – Basic cybersecurity hygiene is broadly accepted across the government and the private sector as a way to reduce a significant percentage of cyber risks. For acquisitions that present cyber risks, the government should only do business with organizations that meet such baseline requirements in both their own operations and in the products and services they deliver. The baseline should be expressed in the technical requirements for the acquisition and should include performance measures to ensure the baseline is maintained and risks are identified. FAR 4.17 – Basic Safeguarding of Contractor Information (not in FAR yet) could be updated to add definitions and solicitation provisions/contract clauses. FAR Part 7 – Acquisition Planning, could be updated to more explicitly require the government to consider cybersecurity requirements in the technical requirements of contracts. FAR Par 12 – Acquisition of Commercial Items could be updated to require solicitation provisions/contract clauses to apply to commercial items. FAR 52 – Development of solicitation provision(s) and contract clause(s) for cybersecurity. FAR4.4 – Safeguarding Classified Information Within Industry should also be reviewed for updates related to cybersecurity. FAR Part Management of Risk – could be updated to address certain types of cyber risk associated with IT contracts. 5

8(e) Recommendations & Potential Impact (cont’d) RecommendationPotential Impact II. Address Cybersecurity in Relevant Training – As with any change to practice or policy, there is a concurrent need to train the relevant workforces to adapt to the changes. Incorporate acquisition cybersecurity into required training curricula for appropriate workforces. Require organizations that do business with the government to receive training about the acquisition cybersecurity requirements of the organization’s government contracts. FAR 52 – clauses might be developed to require specific training for certain types of contracts where cyber risks are high. Note: OFPP, GSA (FAI), DHS (HSAI), and DoD (DAU) are meeting Jan 16th to start implementing this recommendation. Ms. Joanie Newhart, Associate Administrator for Acquisition Workforce Programs in the Office of Federal Procurement Policy, has agreed to convene/charter this informal group with the purpose that the initial training be developed and provided to Acquisition Workforce personnel government-wide. The meeting will gather stakeholder representatives from the relevant acquisition training communities to begin development of (1) course curriculum, (2) training policy, and (3) project plans. 6

8(e) Recommendations & Potential Impact (cont’d) RecommendationPotential Impact III. Develop Common Cybersecurity Definitions for Federal Acquisitions – Unclear and inconsistently defined terms lead, at best, to suboptimal outcomes for both efficiency and cybersecurity. Increasing the clarity of key cybersecurity terms in federal acquisitions will increase efficiency and effectiveness for both the government and the private sector. Key terms should be defined in the Federal Acquisition Regulation. One option is to consider efforts already underway dealing with higher-level quality standards and detection and avoidance of counterfeit electronic parts. (FAR Case Higher-Level Contract Quality Requirements). This case revises FAR to add new higher-level quality standards developed by industry for counterfeit goods. Using this case as an example, FAR 46 – Quality Assurance, could also be revised to include industry standards for cybersecurity in commercial items. FAR 39 – Acquisition of Information Technology could be updated to consider applicable definitions. FAR 2 – Definitions of Words and Terms, is probably the most obvious place to promulgate new acquisition definitions. 7

8(e) Recommendations & Potential Impact (cont’d) RecommendationPotential Impact IV. Institute a Federal Acquisition Cyber Risk Management Strategy – From a government-wide cybersecurity perspective, identify a hierarchy of cyber risk criticality for acquisitions. To maximize consistency in application of procurement rules, develop and use “overlays” for similar types of acquisition, starting with the types of acquisitions that present the greatest cyber risk. An overlay is a fully specified set of security requirements and supplemental guidance that provide the ability to appropriately tailor security requirements for specific technologies or product groups, circumstances and conditions, and/or operational environments. The FAR could be updated to provide standardized source selection criteria, weighting for those criteria, and contract performance measures for procurements that present high levels of cyber risk. Note: OMA/FAS/OGP are engaged in market research and needs assessment with DHS, DoD OCIO, DIA, DISA and NIST to develop a supply chain risk management function to complement the processes used for National Security Systems. 8

8(e) Recommendations & Potential Impact (cont’d) RecommendationPotential Impact V. Include a Requirement to Purchase from Original Equipment Manufacturers, Their Authorized Resellers, or Other Trusted Sources, in Appropriate Acquisitions – In certain circumstances, the risk of receiving inauthentic or otherwise nonconforming items is best mitigated by obtaining required items only from OEMs, their authorized resellers, or other trusted sources. The cyber risk threshold for application of this limitation of sources should be consistent across the Federal government. The FAR could be updated to require consideration of cyber risk when determining the type of acquisition method (best value vs. LPTA) used. The FAR could be updated to require purchases from a reseller, distributor, wholesaler or broker that is a trusted supplier with the original equipment manufacturer (OEM) or obtain assurances that the supplier can guarantee the security and integrity of the item being purchased. Potential conflicts with competition rules would have to be addressed. VI. Increase Government Accountability for Cyber Risk Management – Identify and modify government acquisition practices that contribute to cyber risk. Integrate security standards into acquisition planning and contract administration. Incorporate cyber risk into enterprise risk management and ensure key decision makers are accountable for managing risks of cybersecurity shortfalls in a fielded solution. The FAR could be updated to ensure contract administration matters relevant to cybersecurity are considered (i.e., past performance, Federal Awardee Performance and Integrity Information Systems (FAPIIS), debarment/suspension, etc.) 9

Presidential Policy Directive 21 Designates GSA as Co-Sector Specific Agency (SSA) for Government Facilities Sector with DHS Requires GSA, in consultation with DoD and DHS, to: –“[P]rovide or support government-wide contracts for critical infrastructure systems and ensure that such contracts include audit rights for security of critical infrastructure.” –1 st next step - define which contracts are “for critical infrastructure systems,” and what the “audit rights for security” specifically encompass Critical infrastructure systems could be any that support government essential functions, agency mission essential functions, or any functions on the DHS list of Critical Infrastructure at Greatest Risk of Cyber Attack GSAM provides a good starting point for defining the limits of the audit rights 10

Open Questions Establish a govt-wide program/function at GSA? –Is there an appetite in the community for starting to address the acquisition cyber risk in “non-covered” acquisitions? –Is it possible to define in a specific way which types of buys present cyber risks (i.e., NAICS, PSCs, FSCs, NSNs?)? –How do we prioritize? Is FIPS-199 high or moderate a good starting point? –What about non-covered, non-IT acquisitions (i.e., those that would not get a FIPS rating)? No doubt, many present at least the possibility of cyber risk, how do/should those risks be assessed? Ranked by mission criticality? and if yes, how is that defined? Business Case needs: –An articulation of need for "commercial" (OSINT-based) SCRM from customers, and –A general scope of what types of acquisitions the need applies to (e.g., a list of PSCs, NAICS, FIPS ratings, ???). 11