Security Authorizations Trickle In As Deadlines Near on $50 Billion Telecom Contract

Agencies have until September to award task orders off the massive Enterprise Infrastructure Solutions telecommunications contract, but as of Thursday, only one vendor has met the security requirements to be eligible for award.

The EIS contract is expected to be worth $50 billion over 15 years, as every federal agency—civilian and defense—is preparing to solicit services ranging from basic telecom to video and voice over IP to wholesale infrastructure modernization. As the backbone infrastructure for all data and communications transiting in and out of agency networks, the nine companies with spots on the contract will have to meet stringent cybersecurity standards, documented and verified through an authority to operate, or ATO.

CenturyLink announced last week that it was the first to complete the ATO process.

“We’re excited to be the first vendor to receive an ATO on EIS so we can immediately help federal agencies jumpstart their IT modernization plans and use the latest technology to carry out their missions more efficiently,” David Young, CenturyLink’s senior vice president for strategic government, said in an announcement. “For example, agencies that have already issued EIS RFPs can now start awarding EIS task orders.”

A General Services Administration spokesperson told Nextgov two more vendors are expected to get their ATOs in the coming weeks. A status report shows telecom giants AT&T and Verizon are both close behind CenturyLink in the process. Verizon confirmed to Nextgov the company is close to final approval.

“We've been working with GSA diligently for several months and we expect to have our ATO soon,” said Mike Maiorana, senior vice president for public sector at Verizon. “We look forward to building upon our decades-long relationship with federal government and delivering next generation, mission-enabling services to address government and citizen needs.”

Several remaining vendors should have ATOs before the end of the year, the GSA spokesperson said.

Agencies are on a tight timeline to make task order awards, as all contracts under the previous vehicles, Networx and WITS-3, expire by 2023. In order to ensure a smooth transition, GSA, which is managing the EIS contract, is requiring all agencies to have solicitations published by March 31 and awards made by Sept. 30.

The vendors do not need to have ATOs before the solicitations are issued but do need to be authorized before award. The companies are contractually obligated to get their security authorizations before award.

“There are no shortcuts in federal cybersecurity, so all EIS suppliers must thoroughly and accurately complete every part of the security [assessment and authorization] process and be granted an ATO,” the GSA spokesperson said.

Getting an ATO is a notoriously long and difficult process, complicated further by the short timeline and requirement to get all nine vendors authorized. As GSA was pushing agencies to prepare their solicitations, the agencies were pushing back.

Agencies were saying, “’you’re pushing us to get these solicitations out on the street but these companies don’t have ATOs,’” according to Kay Ely, who led the EIS efforts as assistant commissioner of GSA’s Office of Information Technology Category before she retired last year. “You can’t award an EIS task order until a company has an ATO.”

The difficult ATO timeline, along with a broader effort to push IT modernization through EIS, led GSA in December to extend the transition deadlines by three years in December and realign resources to speed the authorization process.

The agency created a cross-functional tiger team made up of the Office of Telecommunications Services, the Federal Acquisition Services Information Systems Security Manager and a Contractor Systems Security Officer, which meet daily with the vendors to ensure they’re making progress collecting all the necessary documentation for the review.

Once the packages are ready, the Office of the Chief Information Officer, led by CIO David Shive, assesses whether the vendor meets the security standards and officially grants the ATO.

Shive’s office began leading those efforts in the fall with the goal of rolling out ATOs between late 2018 and early 2019. The 35-day government shutdown slowed that progress some but efforts have since gotten back on track.

“They stepped up and put in some additional resources,” Ely said, noting other enclaves in GSA have been helping, as well, such as the 18F team, which has developed strategies to speed the ATO process.

Editor's Note: This story has been updated to better reflect the timeline on remaining authorizations.