Why GSA’s OneGov Technique Might Face Implementation Hurdles

A White Home effort to streamline federal data know-how buying by means of the Common Companies Administration’s new “OneGov” technique might assist additional centralize shopping for energy and enhance cybersecurity by means of standardized contracts. Procurement specialists warn it might additionally conflict with the administration’s broader push to decontrol and strip down longstanding acquisition guidelines.

GSA stated in a latest assertion that OneGov will give businesses simpler entry to IT instruments with standardized phrases and pricing and supply unique gear producers a extra direct and predictable engagement mannequin. Early offers embody a serious settlement with Google that gives a short lived 71% low cost on Google Workspace for federal businesses, and a 70% low cost from Adobe on its Paperless Authorities Answer.

GSA has stated the OneGov technique “will evolve over time” and increase into areas akin to {hardware}, platforms, infrastructure and cybersecurity companies.

Specialists instructed Data Safety Media Group they’re “cautiously optimistic” that future phases of the OneGov technique might increase entry to stronger, lower-cost cybersecurity instruments throughout authorities, as GSA has pledged. Some raised issues that the method might sideline smaller distributors and undercut ongoing efforts to favor extra versatile, nontraditional procurement fashions that keep away from centralized buildings altogether.

Alan Chvotkin, a federal procurement skilled and accomplice at Centre Legislation and Consulting, stated standardizing buy phrases throughout authorities buys might yield main advantages in consistency, cut back compliance burdens for businesses and contractors and probably decrease trade prices. However GSA’s affect has its limits, he stated, particularly relating to agency-specific cybersecurity necessities.

“I don’t imagine it’s GSA’s expectation that will probably be capable of power shopping for actions into accepting GSA-negotiated phrases and situations in lieu of each agency-specific requirement,” Chvotkin instructed Data Safety Media Group. “For instance, will GSA’s cyber phrases and situations supplant or exclude DOD’s CMMC necessities? Or one other company’s statutory mandate? I doubt it.”

The OneGov technique was launched following an April 16 White Home directive calling for a sweeping overhaul of federal procurement coverage to spice up competitors, reduce prices and streamline acquisition guidelines. Kevin Rhodes, senior advisor on the Workplace of Administration and Price range, stated in an announcement {that a} deliberate rewrite of the Federal Acquisition Regulation “will cut back greater than 40 years of bureaucratic buildup that can unleash our procurement system with generational change and outcomes.”

A number of analysts warned the OneGov technique might overshadow the president’s federal procurement directive and a separate government order aimed toward streamlining protection acquisitions. That order prioritizes industrial options choices and Different Transaction Authority, two procurement strategies not ruled by the FAR.

A key check of the OneGov technique’s effectiveness in enhancing cybersecurity will likely be whether or not it streamlines the gradual, usually dysfunctional course of distributors face when searching for approval to function in Federal Danger and Authorization Administration Program environments, Greg Anderson stated, CEO of DefectDojo and a former Pentagon penetration tester. Anderson instructed ISMG that “the method to amass ATO standing has basically floor to a halt,” forcing distributors to accomplice with third events that already maintain Authorization to Function credentials.

“If the ATO standing will get revised from its basically damaged state, this will likely be an enormous win for distributors, taxpayers, authorities workers and the federal authorities itself, offered correct due diligence procedures are nonetheless in place,” Anderson stated, including that he stays involved about due diligence and noting how shut the federal authorities’s Frequent Vulnerabilities and Exposures program got here to shutting down (see: Cybersecurity Alarms Sound Over Lack of CVE Program Funding).

“The massive query is that this: What does the federal government do if a smaller vendor that has turn into important all of a sudden goes out of enterprise?” he added.

Whereas OneGov might assist simplify procurement, it additionally raises questions on how a direct-to-manufacturer mannequin will work in advanced, multi-vendor environments like crucial infrastructure.

Authentic gear producers may be efficient when a single-vendor answer is possible, however most important infrastructure environments depend on a number of distributors – even throughout the similar facility – Dan Gunter stated, CEO of cybersecurity agency Insane Cyber and former cyber warfare officer for the U.S. Air Pressure. Whereas OEMs might know their very own know-how finest, Gunter stated the extra sensible method usually displays the truth that plant environments are heterogeneous.

“OEMs may be pushed to maximise their contract values when a heterogeneous answer could also be superb,” he stated. “An asset proprietor would probably have to work with all of their OEMs individually moderately than depend on a trusted, agnostic vendor to handle these relationships.”

Analysts warned that the OneGov technique might push the federal authorities to favor merchandise from giant, contracted software program distributors over extra superior options. Important infrastructure and delicate mission methods – usually tied to operational know-how and legacy platforms – can also face “integration hurdles,” stated Felipe Fernandez, chief know-how officer at Fortinet Federal.

Important infrastructure IT environments demand “an understanding of mission context and systemic danger,” Fernandez stated. Whereas OEMs will “definitely proceed to supply supporting know-how,” he added, “the setting requires extra than simply merchandise.”

“The crucial for businesses then can be to not completely disregard value-added partnership experience within the know-how choice course of,” Fernandez instructed ISMG.

GSA didn’t reply to requests for touch upon how the OneGov technique may operate throughout the already crowded panorama of federal regulatory procurement, or how it will align with present cybersecurity frameworks. The White Home additionally didn’t reply to a request for remark.