GSA Requires Cyber Plans for Contractors

In a final rule published January 6th in the Federal Register, prime- and sub- contractors providing the General Services Administration with information technology supplies, services or systems are required to submit an IT security plan outlining compliance with federal cybersecurity regulations. The rule applies to contracts and orders awarded after January 6, 2012 that include information technology (IT) supplies, services and systems with security requirements.

Contractors must provide GSA access to facilities, installations, operations, documentation, databases, IT systems and devices, and personnel used in performance of the contract, “to the extent required, in GSA’s judgment,” for inspection or audit.” The GSA recognized formally that the rule would have “a significant economic impact on a significant number of small entities.” Read the full rule here.