Why GSA’s OneGov Technique Might Face Implementation Hurdles

A White Home effort to streamline federal data expertise buying via the Basic Providers Administration’s new “OneGov” technique might assist additional centralize shopping for energy and enhance cybersecurity via standardized contracts. Procurement consultants warn it may additionally conflict with the administration’s broader push to decontrol and strip down longstanding acquisition guidelines.

GSA stated in a current assertion that OneGov will give companies simpler entry to IT instruments with standardized phrases and pricing and provide unique gear producers a extra direct and predictable engagement mannequin. Early offers embrace a significant settlement with Google that gives a brief 71% low cost on Google Workspace for federal companies, and a 70% low cost from Adobe on its Paperless Authorities Resolution.

GSA has stated the OneGov technique “will evolve over time” and increase into areas similar to {hardware}, platforms, infrastructure and cybersecurity providers.

Specialists informed Info Safety Media Group they’re “cautiously optimistic” that future phases of the OneGov technique may increase entry to stronger, lower-cost cybersecurity instruments throughout authorities, as GSA has pledged. Some raised considerations that the strategy might sideline smaller distributors and undercut ongoing efforts to favor extra versatile, nontraditional procurement fashions that keep away from centralized buildings altogether.

Alan Chvotkin, a federal procurement skilled and associate at Centre Regulation and Consulting, stated standardizing buy phrases throughout authorities buys may yield main advantages in consistency, cut back compliance burdens for companies and contractors and doubtlessly decrease business prices. However GSA’s affect has its limits, he stated, particularly in the case of agency-specific cybersecurity necessities.

“I don’t consider it’s GSA’s expectation that will probably be capable of pressure shopping for actions into accepting GSA-negotiated phrases and situations in lieu of each agency-specific requirement,” Chvotkin informed Info Safety Media Group. “For instance, will GSA’s cyber phrases and situations supplant or exclude DOD’s CMMC necessities? Or one other company’s statutory mandate? I doubt it.”

The OneGov technique was launched following an April 16 White Home directive calling for a sweeping overhaul of federal procurement coverage to spice up competitors, reduce prices and streamline acquisition guidelines. Kevin Rhodes, senior advisor on the Workplace of Administration and Price range, stated in a press release {that a} deliberate rewrite of the Federal Acquisition Regulation “will cut back greater than 40 years of bureaucratic buildup that can unleash our procurement system with generational change and outcomes.”

A number of analysts warned the OneGov technique may overshadow the president’s federal procurement directive and a separate government order aimed toward streamlining protection acquisitions. That order prioritizes industrial options choices and Different Transaction Authority, two procurement strategies not ruled by the FAR.

A key check of the OneGov technique’s effectiveness in bettering cybersecurity will likely be whether or not it streamlines the sluggish, typically dysfunctional course of distributors face when searching for approval to function in Federal Threat and Authorization Administration Program environments, Greg Anderson stated, CEO of DefectDojo and a former Pentagon penetration tester. Anderson informed ISMG that “the method to accumulate ATO standing has primarily floor to a halt,” forcing distributors to associate with third events that already maintain Authorization to Function credentials.

“If the ATO standing will get revised from its essentially damaged state, this will likely be an enormous win for distributors, taxpayers, authorities workers and the federal authorities itself, offered correct due diligence procedures are nonetheless in place,” Anderson stated, including that he stays involved about due diligence and noting how shut the federal authorities’s Frequent Vulnerabilities and Exposures program got here to shutting down (see: Cybersecurity Alarms Sound Over Lack of CVE Program Funding).

“The massive query is that this: What does the federal government do if a smaller vendor that has change into important out of the blue goes out of enterprise?” he added.

Whereas OneGov may assist simplify procurement, it additionally raises questions on how a direct-to-manufacturer mannequin will work in advanced, multi-vendor environments like vital infrastructure.

Authentic gear producers could be efficient when a single-vendor answer is possible, however most important infrastructure environments depend on a number of distributors – even inside the similar facility – Dan Gunter stated, CEO of cybersecurity agency Insane Cyber and former cyber warfare officer for the U.S. Air Power. Whereas OEMs might know their very own expertise greatest, Gunter stated the extra sensible strategy typically displays the fact that plant environments are heterogeneous.

“OEMs could be pushed to maximise their contract values when a heterogeneous answer could also be preferrred,” he stated. “An asset proprietor would doubtlessly must work with all of their OEMs individually quite than depend on a trusted, agnostic vendor to handle these relationships.”

Analysts warned that the OneGov technique may push the federal authorities to favor merchandise from massive, contracted software program distributors over extra superior options. Important infrastructure and delicate mission programs – typically tied to operational expertise and legacy platforms – may additionally face “integration hurdles,” stated Felipe Fernandez, chief expertise officer at Fortinet Federal.

Important infrastructure IT environments demand “an understanding of mission context and systemic threat,” Fernandez stated. Whereas OEMs will “definitely proceed to offer supporting expertise,” he added, “the atmosphere requires extra than simply merchandise.”

“The crucial for companies then could be to not completely disregard value-added partnership experience within the expertise choice course of,” Fernandez informed ISMG.

GSA didn’t reply to requests for touch upon how the OneGov technique would possibly operate inside the already crowded panorama of federal regulatory procurement, or how it might align with current cybersecurity frameworks. The White Home additionally didn’t reply to a request for remark.