Government contracts 2022 — Year in review

January 5, 2023 by Leave a comment

By Hollie Kapos, Legal Counsel Director, immixGroup

2022 was a busy year, and it was easy to miss some big changes in commercial item government contracting. Below are some key updates from 2022 and what immixGroup is keeping an eye on in 2023 and beyond.

GSA Ascend BPA for Cloud
Ascend is a multiple-award blanket purchase agreement (BPA) under the cloud and professional services Multiple Award Schedule SINs intended to simplify acquisition of secure cloud solutions. Task orders under the BPA will be placed under one or more of three pools: (1) infrastructure- and platform-as-a-service, (2) software-as-a-service, and (3) cloud IT professional services. The BPA will also establish minimum cybersecurity requirements, including cybersecurity supply chain risk management (C-SCRM) and zero trust architecture (ZTA). GSA released a draft performance work statement in May, followed by a market research request for information in July. Using feedback it obtained from industry, GSA plans to release a draft request for quotations in 2Q2023. Suppliers looking to add products to the Ascend BPA should start preparing now; products will need to be on SIN 518210C for eligibility. Read Tara Franzonello’s Washington Technology article for more information.

Read more of this post

Filed under Contracting, Market Intelligence, Sales Tagged with , , , , , ,

The Fed’s EDR focus will unlock opportunities in cyber defense

January 26, 2022 by Leave a comment

By Amanda Mull, Contract Specialist

The cybersecurity of the federal government is constantly under attack.  A recent FISMA report from the Office of Management and Budget noted that in FY2020, agencies reported 30,819 cybersecurity incidents to the U.S. Computer Emergency Readiness Team. The variety of attack vectors continues to evolve, creating a dynamic threat landscape.

The government is addressing this challenge by mandating Endpoint Detection and Response (EDR) tools. Companies that can offer these tools and capabilities will be well-positioned to build their federal customer portfolio.

EDR is an integrated security solution that detects threats by combining real-time continuous monitoring and collection of endpoint data with rules-based automated responses and analysis capabilities. The data collected helps determine system security. Evaluation and machine analysis of the data provides coordinated detection of threats and conditions that elicit programmed responses, including follow up via human notifications and further actions to mitigate any potential or actual threats. 

EDR initiatives and Approved Product listing

On January 10, the Cybersecurity and Infrastructure Security Agency announced an expanded and revised EDR technical capability definition and new requirements for adding EDR items to the Department of Homeland Security’s Continuous Diagnostics and Mitigation Program’s Approved Product List.

The federal EDR initiative includes a CISA dashboard to record data collected from all federal executive agency and department information systems. The dashboard metrics are intended to provide an overall federal cyber threat analysis. OMB and other federal actors plan to use the dashboard metrics to evaluate vulnerabilities and make budgetary decisions to fund cybersecurity improvements.

Agency EDR responsibilities and FISMA updating

Expectations for agency engagement are high. EDR implementation is mandated, and agencies must continue to develop and mature their EDR solutions – along with continued reporting of endpoint data to the coordinated CISA federal dashboard.

Read more of this post

Filed under CDM, Contracting, Sales Tagged with , , ,

CDM Notes: EO 14028 deadline is looming. Is your company ready to help?

October 6, 2021 by Leave a comment

By Amanda Mull, Contract Specialist

Cybersecurity specialists in the federal government are probably feeling the pinch right about now. By October 9, agencies will need to report on their current software systems as part of Executive Order 14028 on Improving the Nation’s Cybersecurity. If you are a vendor of cybersecurity products, you’d be well advised to make sure your business is appropriately listed – sooner, not later.

Following completion of their EO/OMB reports, agencies are to identify areas at high risk for cyberattacks – such as data theft, ransomware, and disturbances or exploitation of email or other communications.  By Identifying these vulnerabilities and whether agencies may be dependent on specific software or system providers, the federal government hopes to gain greater insight into problem areas.

Read more of this post

Filed under CDM, Contracting Tagged with , , ,

The Future of the GSA CDM SIN: What it means to you

August 17, 2021 by Leave a comment

By Gina Brown, Federal Contracts Manager

In August 2018, the CDM program underwent a procurement transition that vendors should keep in mind. Combined with a proposed elimination of the GSA CDM special item number (SIN), the changes could streamline certain aspects of the way in which products are catalogued.

Initially, blanket purchase agreements (BPAs) were awarded to 17 primes. This then switched to a two-pronged acquisition strategy, in which four GSA Alliant prime contractors were awarded six Dynamic and Evolving Federal Enterprise Network Defense (DEFEND) task orders.

These prime system integrators would purchase cybersecurity tools according to the DHS approved product list (APL), to strengthen the security posture of civilian agency customers.

Read more of this post

Filed under CDM, Contracting, Market Intelligence, Sales Tagged with , , , ,

CDM: Cloud Hardening and Zero Trust Environments

August 12, 2021 by Leave a comment

By Amanda Mull, Contract Specialist

Critical cybersecurity goals for most federal agencies are focused on Zero Trust for a more mobile workforce, cloud-based products, and active threat detection plus dynamic response. Purchase of tools alone, however, cannot provide successful operational cybersecurity. Ongoing budgeting must address a holistic approach, including flexible policies and procedures, to adjust to new threats and changing work landscapes – along with a critical investment in cyber workforce training.

It is becoming more important for federal agencies to partner with companies that can help achieve their foundational cybersecurity goals. Partners and agencies alike must be committed to constant review and adjustment to systems and operations, to ensure that they maintain the highest levels of cybersecurity.

CDM program funds directly support agencies striving to harden their cloud cybersecurity against threats. The program becomes even more important as new threats emerge and agencies are forced to scramble to protect themselves and the public trust. 

Read more of this post

Filed under CDM, Contracting, Market Intelligence, Sales Tagged with , , ,

The Cybersecurity Executive Order: What’s coming and where are the opportunities?

July 21, 2021 by Leave a comment

By Davis Johnson, VP & General Manager

Private sector companies have a considerable amount of work to do to comply with the recent Presidential Executive Order on Improving the Nation’s Cybersecurity. Existing contracts must be scrutinized to reduce the trend of serious cyberattacks across government and industry alike.

It’s clear that the order puts the onus on the vendor community. It reads, in part, “The private sector must adapt to the continuously changing threat environment, ensure its products are built and operate securely, and partner with the Federal Government to foster a more secure cyberspace.”

The order further recommends standardizing common cybersecurity contractual requirements across agencies, to “streamline and improve compliance for vendors and the Federal Government.”

Beyond the effect on contract implications, vendors can expect more attention from the government in several key technology areas, which will spark greater demand and more funding. Here are just a few:

Cyber Vulnerability and Incident Detection

Agencies are required to establish a Memoranda of Agreement with CISA for Continuous Diagnostics and Mitigation. CISA is required to report quarterly to OMB and the National Security Advisor on implementation of threat-hunting practices. Vendors can expect more contact with agencies as these reports and documents are being prepared.

Read more of this post

Filed under Market Intelligence, Sales Tagged with , , , ,

CDM Updates to Product Listing Requirements

July 14, 2021 by Leave a comment

By Amanda Mull, Contract Specialist

The federal Continuous Diagnostics and Mitigation (CDM) program includes cybersecurity tools and sensors that are reviewed by the program for conformance with Section 508, federal license users and CDM technical requirements. Manufacturers are encouraged to update, refresh and add new and innovative tools to the CDM Approved Products List (APL).

To maintain currency with federal and requirement and the constant evolution of the cyber/IT landscape, the CDM APL product submission requirements have been revised several times in FY2021.

The most recent updates reflect heightened security policies and protocols required for a more mobile workforce. Others support the full realization of the federal CDM Dashboard expected by year-end. The CDM Dashboard is intended to gauge agency cybersecurity posture. It also monitors the achievement of directives meant to raise the overall level of security and privacy in cyber/IT tools and technology across the federal government.

There have been several recent updates to CDM Common Requirements for Approved Product Listings (APL):

Read more of this post

Filed under CDM, Contracting, Market Intelligence, Sales Tagged with , , , , ,

CDM IPv6 compliance plans due July 6: Why the technology matters

June 29, 2021 by 1 Comment

By Amanda Mull, contract specialist

As I mentioned in my previous blog, there have been some changes to CDM. The Cybersecurity and Infrastructure Security Administration (CISA) announced recently that the common requirements for the Continuous Diagnostics and Mitigation (CDM) Program had been updated to align with the extended compliance schedule published in the Office of Management and Budget (OMB) Memorandum 21-07 (M-21-07) – PDF.

By FY2023, all federal information systems must be Internet Protocol version 6 (IPv6) enabled. This is an important policy move for acquiring information technology (IT) products and services contained in Federal Acquisition Regulation (FAR) 11.002.

On June 4, CISA directed suppliers with CDM-approved products suspected of not being natively IPv6 compliant to provide proofs of capability or a plan for becoming compliant by July 6, 2021. CISA will conditionally approve products that are not fully IPv6 compliant, providing applicants submit an acceptable plan detailing how their products will become fully operational in an IPv6-only network by the end of FY2023. CISA intends to perform periodic progress checks on accepted plans.   

Read more of this post

Filed under CDM, Contracting, Market Intelligence, Sales Tagged with , , ,

CDM: More relevant than ever

June 17, 2021 by Leave a comment

By Amanda Mull, contract specialist

With the recent incidents involving ransomware and other serious data breaches, security remains a top priority in federal IT.

It’s been some time since we published our last blog on CDM, so to keep our channel partners and suppliers up to date on recent changes, in the coming weeks we will be publishing a series of CDM-related blogs.

In this, our first blog, we provide some basic information and discuss a recent leadership change. Future blogs will cover the federal CDM Dashboard, IPv6 compliance, updates to common requirements and the future of the CDM SIN.

Here are some of the basics about the program:

Continuous Diagnostics and Mitigation Program 

The CDM Program was developed in 2012 to support government-wide and agency-specific efforts to provide risk-based, consistent, and cost-effective cybersecurity solutions to protect federal civilian networks across all organizational tiers.

Read more of this post

Filed under CDM, Contracting, Market Intelligence, Sales Tagged with , , ,

Vendor Innovations in Cybersecurity: From Browsers to IoT to Mobile

May 29, 2019 by Leave a comment

By Tim Larkins, Senior Director, Market Intelligence and Corporate Development

Threats to network security have evolved and vulnerable attack vectors have expanded – from browsers to mobile devices to the increasingly interconnected appliances that are part of the Internet of Things (IoT). Vendors of cybersecurity solutions are now branching out beyond their initial niches to embrace wider aspects of security.

In immixGroup’s recent panel discussion during Cyber Ops Demo Day held earlier this month, six of industry’s most prominent vendors each described what they were doing to help prevent security breaches in this era of multiple security attack vectors.

Marlin McFate, federal CTO, Riverbed Technology, said his company has broadened its reach beyond network monitoring, application monitoring and user monitoring to security issues ranging from insider threat to exfiltration. Riverbed’s acquisition of FlowTraq has integrated that capability into its visibility solution. The technology allows for security problems to be analyzed from a behavioral perspective, to identify devices that are no longer acting like normal appliances or system users that are not actually part of the organization.

Read more of this post

Filed under Market Intelligence, Sales Tagged with , ,

← Older posts

%d bloggers like this: