GSA Seeks Comments on Transfer of .Gov Domain to Cybersecurity Agency

The General Services Administration is preparing to complete its hand-off of .gov websites to the Cybersecurity and Infrastructure Security Agency in recognition of a growing need to protect the top-level internet domain as critical infrastructure.

GSA invited public comment within 60 days on an interim rule for the transfer that will take effect Monday. The move was authorized under the DOTGOV Act of 2020 which became law as part of the Consolidated Appropriations Act, 2021.

“.gov is critical infrastructure,” reads a notice set to publish in the Federal Register.  “It’s central to the availability and integrity of thousands of online services relied upon by millions of users. Since the .gov domain underpins communication with and within these institutions, cybersecurity significance of all aspects of .gov’s administration has been increasing rapidly.”

The transfer got underway in the spring with CISA officials promising to make security improvements to the domain under the law. They have since been rolling out plans to implement a protective email service and domain name system resolver to secure the routing of internet traffic. 

In November a CISA official told Nextgov he couldn’t say exactly when in 2022 the DNS resolver would be available, but that the effort is contracted to Accenture Federal and CloudFlare and will be deployed “as soon as possible.”

The .gov sites are unique among the six top-level domains familiar to internet users. Unlike other domains such as the ubiquitous .com, for example, it does not have an official registry agreement with the Internet Corporation for Assigned Names and Numbers, or ICANN. Registration and management of .gov sites occur instead through dotgov.gov, which is scheduled for maintenance Wednesday.

“The .GOV Domain Name Registration website will undergo a scheduled maintenance on Wednesday, January 12, 2022, after 9 PM EST. You may not be able to access domains.dotgov.gov to make new domain name requests or modifications for a period of time during the maintenance window,” reads a notice posted on the site. “All .GOV domain names will resolve normally throughout the maintenance.”

Under the law, .gov domains must be made available at zero or negligible costs to any state, local, territorial or tribal entity under public control. 

CISA’s registration of a new .gov site for federal agencies must first be approved by the Office of Management and Budget, according to the law.