StateRAMP: An Outgrowth of FedRAMP for SLED

By Troy Fortune, VP & General Manager

Is StateRAMP on your radar screen? If you are a cloud software vendor and trying to sell into the state, local and education market, I encourage you to pay attention.

Modeled after FedRAMP, StateRAMP is gaining traction among many state CIOs. For the last seven years cybersecurity has topped the priority lists for CIOs at the state, local and education (SLED) levels, yet there are no established security standards they have all agreed to.

StateRAMP plans to leverage the existing FedRAMP assessment and approvals processes to help simplify the implementation for government and industry. Logistics for FedRAMP to StateRAMP transitions are still being finalized but vendors should look for the marketplace to launch in Q2 of 2021.

Cyberattacks on the Rise

Cyberattacks in SLED have amped up in recent years and become increasingly sophisticated, targeting sensitive citizen PII data. Many organizations have begun taking steps to protect their databases and systems, but those measures vary widely from state to state and even department to department. The expanded use of cloud-based systems to house and manage critical services like Medicaid and unemployment insurance only increases the risk. Unfortunately, few standards exist for cybersecurity or cloud security, which makes the protection of their sensitive data even more challenging.

Read more of this post

Getting Started With OTAs (Part 2 of 2)

By Troy Fortune, VP and General Manager

In my previous blog I talked about how OTAs can offer real advantages to both government agencies and suppliers. This blog provides more information about the types of OTAs and when they should be used. We also provide tips on how to assist your potential customers in the process.

There are three categories of OTAs and it’s important for you to know how and when they’re used.

  1. Research OTAs (also known as “original” or science and technology OTAs) are for basic, applied and advanced research projects. These OTs are intended to spur dual-use research and development. Companies can take advantage of economies of scale without the burden of government regulatory overhead.
  2. Prototype OTAs are authorized for acquiring prototype capabilities and allowing those prototypes to transition into Production OTAs. Both dual-use and defense-specific projects are encouraged. Successful Prototype OTAs streamline the transition into follow-on production without competition. They also reduce the possibility of a future protest.
  3. Production OTAs are authorized as noncompetitive, follow-on OTAs to a Prototype OT agreement that was competitively awarded and successfully completed. Under this statute, advanced consideration is required, and notice is to be made of the potential for a project to go into production.

Read more of this post

Getting Started With OTAs (Part 1 of 2)

By Troy Fortune, VP and General Manager

An OTA (Other Transaction Authority) can be a powerful alternative to a traditional contract vehicle. OTAs have been in use for years but they have become more popular since Congress relaxed rules and restrictions. In fact, Bloomberg reports that government spending on OTAs increased almost eight-fold from FY15-FY19, from $1B to $7.8B. This includes all OTAs, not just for information technology solutions.

OTAs can provide a rapid way to deliver solutions the government needs. This can be an especially valuable tool for government to acquire technology from companies that may offer cutting edge or emerging technologies but are not set up to do business with the government.

The speed with which OTAs can be executed is a real benefit. On its website, DOD cited  the example of how the Air Mobility Command was able to “take a requirement and turn it into a product in just 95 days, when the process might normally take more than a year to complete.”

Many of our suppliers have asked for our help in understanding how OTAs work and how to navigate the process. Here is some basic information to get you thinking about whether or not this might be something your company should pursue. Read more of this post

If You Sell to DOD, Pay Attention to CMMC

By Troy Fortune, Vice President & General Manager

You’ve probably heard that the Department of Defense (DOD) recently released the official version 1.0 of its new Cybersecurity Maturity Model Certification (CMMC 1.0).

This is one of the hottest topics in government contracting right now and immixGroup is following developments very closely. And, it will affect everyone in our industry who sells to DOD – resellers, distributors and OEMs. 

As a quick refresher, this is a cybersecurity standard that all contractors must meet if they want to do business with DOD. As we’ve discussed before in a previous blog, the standards themselves are taken from existing ones. With CMMC 1.0, we now have more clarity on what the 5 levels of CMMC entail: Read more of this post

%d bloggers like this: