GSA Quizzes Companies on Cyber Capabilities

The government's federal buying arm is quizzing industry about its cybersecurity offerings to give federal agencies more insight into the types of tools and technologies currently on the market that could help quash common cyberthreats.

Feedback from contractors and information security experts to the General Services Administration "will help GSA identify current offerings available, improve the visibility of those offerings and determine gaps that need to be filled," states an April 11 request for information. Responses are due April 20.

The services listed in the RFI  include, among other things, proactive hunts for adversaries and database assessments of software flaws or misconfigurations, as well as phishing tests. (The full list is below).

“Proactive adversary hunts” start with the assumption that hackers might already be inside an agency's network and are an industry gold standard.

GSA aims for this outreach to "inform the government about the types of cybersecurity products and services that are available to detect and remediate the kinds of cybersecurity vulnerabilities, threats and incidents most prevalent in industry and in government," according to the solicitation. 

Questions for vendors and experts include:

• What are the advantages and/or disadvantages of how the government currently purchases cybersecurity products and services?
• What types of cybersecurity products and services are most commonly sold to your government customers?
• Should the government consider the use of demonstration projects (e.g., “capture the flag”) in evaluating an offeror’s ability in some or all of the cybersecurity services listed?
• Is there a need for new governmentwide contracting vehicle(s) or offerings for the government to purchase some or all of the cybersecurity services listed?

The research project kicked off a week after GSA announced a "startup springboard" trial that would let some firms bypass a requirement that they have two years of contracting experience before landing a spot on the main vehicle through which agencies purchase IT products.

Still, there are persistent concerns there are few inroads for small companies into the federal acquisition maze.

On Friday, Sen. Tom Carper, the top Democrat on the Homeland Security and Government Affairs Committee, sent the department a letter complaining the 2-year requirement "can obviously be difficult for a new company, and could potentially leave agencies more vulnerable to attack if a new company offers an effective cyber defense tool."

The venture capital industry on Friday backed Carper's call for changes in federal cybersecurity shopping.

“Much of the innovation being developed" to confront threats common in industry and government computer threats "is being produced by venture-backed startups and readily used in the private sector,” Bobby Franklin, president of the National Venture Capital Association, said in a statement.” However, because of bureaucratic red tape and outdated federal policies, cybersecurity startups are shut out from the government acquisition process and unable to deliver their products to federal agencies,"

General Service Administration's Wish List of Services

• Network Mapping
• Vulnerability Scanning
• Penetration Testing
• Phishing Assessments (Testing and Scanning)
• Wireless Assessments
• Web Application Assessments
• Operating System Assessments
• Database Assessments
• Proactive Adversary Hunt
• Incident Response
• Reactive Adversary Hunt
• Security Engineering Services including Post-incident or Post-assessment Remediation