Are Federal Regs Keeping Agencies From Cutting-Edge Cyber Tools?

The top Democrat on the Senate committee that oversees homeland security is worried federal agencies are behind the curve when it comes to purchasing cutting-edge cybersecurity tools and services. And the government’s hidebound contracting regulations may be to blame.

“As you well know, federal agencies are under a constant yet evolving threat from cyberattackers,” Sen. Tom Carper, D-Del., wrote in an April 7 letter to Shaun Donovan, head of the White House’s Office of Management and Budget. “However, flaws in the federal acquisition process can limit the tools agency network defenders can obtain.”

Carper is the ranking member of the Homeland Security and Governmental Affairs Committee.

In the letter, Carper said he and his staff recently met with several cyber startups. The companies’ message: It’s too hard to break into the federal business.

“The small businesses we met with advised us that financial institutions, power companies, retailers and other private critical infrastructure owners are able to quickly reap the benefits of the many new and innovative cyber defense products put on the market each year,” Carper said in the letter. “Yet, it was not clear to them that federal agencies are similarly able to rapidly acquire new and innovative cybersecurity solutions.”

Carper asked Donovan to provide answers within 30 days to a slew of questions about agencies’ cyber-buying practices, including:

• What agencies are doing to acquire “innovative cyber solutions” developed by startups “and other companies that have not traditionally done business with the government.”
• What steps OMB has taken “to guide agencies in the rapid procurement of new and emerging cybersecurity tools,” including making sure agency contracting officers are properly trained on how to leverage existing flexibilities to rapidly acquire new technology.
• Whether OMB has examined challenges startups face in trying to do business with the government.

There are already some tools at agencies’ disposal to loosen up the federal contracting process, but it’s unclear how widely these are used specifically to purchase cybersecurity services, Carper said.

For example, the simplified acquisition threshold allows agencies to conduct streamlined procurements for services under a certain dollar amount -- currently $150,000. The Obama administration has proposed raising that cap to $500,000.

Still, the flexibility is mostly used to purchase hardware such as routers and desktops and it’s “currently unclear how agencies use this authority to get advanced cyber defense tools into the hands of their network defenders,” Carper said.

The bible of federal procurement rules -- the Federal Acquisition Regulation -- already allows agencies to speed up some contracting actions if they face “an urgent need” or when open competitions would compromise national security.

“It is my understanding, however, that many agencies do not take advantage of these provisions to acquire advanced cyber tools,” Carper wrote.

One of the main vehicles through which agencies purchase IT products -- Schedule 70, essentially a catalog compiled by the General Services Administration of pre-vetted IT hardware, software and services  -- is generally not startup-friendly, because it requires companies to have two years of corporate experience.

“This can obviously be difficult for a new company, and could potentially leave agencies more vulnerable to attack if a new company offers an effective cyber defense tool,” Carper wrote.

(This week, GSA announced a new pilot project, the “startup springboard,” allowing some companies to bypass the 2-year requirement.)

Separately, the Homeland Security Department offers agencies the ability to purchase a suite of automated tools for spotting cyber vulnerabilities.

The Continuous Diagnostics and Mitigation program “is starting to deliver tools and services to agencies, but because of the complexity of the contracting process, it may not be able to offer new tools fast enough to keep up with the threat,” Carper wrote.  

Carper asked OMB to explain how new products can be more rapidly integrated into the CDM program.