Selling cyber now means understanding FITARA

Feds update FITARA metrics to include agency performance in critical cyber needs.

By Tara Franzonello, Program Development Manager

The U.S. House of Representatives Committee on Oversight and Reform (COR) released its 15th  Federal Information Technology Acquisition Reform Act (FITARA) scorecard in December 2022. This latest scorecard introduced a new category for cyber security. 

Agencies’ protests against enacting this key IT legislation have high visibility from agency chief information officers (CIOs) to the General Accounting Office (GAO) to Congress. Technology vendors have an advantage over their competition if they can help agency customers show progress in measured categories. This is now particularly important for FITARA because agency self-assessment for compliance happens every spring.

Why FITARA matters for federal cyber security sales

Understanding the FITARA scorecard categories, researching your agency customers’ scores, and tracking how they may fall short can help you demonstrate exactly how you can help your customers raise their grades.

Awareness of your customer agency’s cyber security progress is critical because the FITARA scorecard now captures additional metrics. That means higher levels of visibility to Congress and transparency in CIO reporting structures. The new category for cyber security is one such metric.

Unlike the current cyber measurement under the FISMA category, which assigns a letter grade to agency progress, the new FITARA metric includes a percentage value for cyber security headway made by agencies. 

Knowing where, why, and how an agency ranks in this new category can provide insightful analysis and a better understanding of an agency’s cyber challenges. It can also offer ideas about how your products and services can address suggested FITARA scorecard problems, drive solutions, and raise scores in subsequent evaluations. 

Proposed changes from industry tie to a cyber executive order

In a 2022 report, the American Council for Technology-Industry Advisory Council (ACT-IAC) suggested changes to the FITARA scorecard. These recommendations helped move away from oversight to a focus on true agency IT transformation, particularly in the area of zero-trust-aligned cyber security. These proposed changes would make it more likely to have the FITARA scorecard aligned with the president’s executive order 14028, improving the nation’s cyber security.

ACT-IAC further recommended metrics that consider supply chain risk management (SCRM) maturity as a component of an agency’s grade. Additional proposed changes included considering multifactor authentication, smart patching, asset management and response, zero-trust progress, and SCRM principles with an eventual weight prioritization based on identified risk areas. The report calls for measurements of where agencies are truly making changes that will meet the spirit of the legislation. 

So, what does this all mean for technology providers? Do your homework! 

• Understand your agency customer’s grade and the data behind it to better align your cyber security solution.
• Know where your customer has gaps.
• Check data in FISMA reporting metrics, DHS’s Continuous Diagnostic and Mitigation Program, and as reported by the CIO or CISO of your client agency.

With that information, you’ll be better equipped to explain how your products and services can help mitigate risk and defend against threats. Key messaging for your solutions should focus on those benefits and how your products and services can help raise your customers’ cyber grades. If you doubt how to accomplish such tasks, consult with those who have expertise in such areas.

---

Keep up to date on the latest trends in government IT. Subscribe to immixGroup’s Government Sales Insider now.

Tara Franzonello is legal services associate for immixGroup, the public sector business of Arrow Electronics. immixGroup delivers mission-driven results through innovative technology solutions for public sector IT. Visit www.immixgroup.com for more information. here.