By Jason Miller
One of the final pieces to improving agency IT security across the
government finally is in place: Starting today, contracting officers
must include cybersecurity requirements in acquisition planning.
The Federal Acquisition Regulations Council issued an interim rule 
today outlining five new steps acquisition workers must take to ensure
IT security is incorporated into all purchases. As an interim rule
taking effect now, the FAR Council will accept comments until Nov. 29.
This rule has been in the works for some time. The E-Government Act of
2002, which included the Federal Information Security Management Act
of 2002, called for increased security in all phases of the system's
lifecycle. And the FAR Council has been writing this rule since 2003 .
"The intent of adding specific guidance in the FAR is to provide
clear, consistent guidance to acquisition officials and program
managers," the rule said, "and to encourage and strengthen
communication with IT security officials, CIOs and other affected
* Requires acquisition professionals to seek the advice of IT security
* Defines information security
* Incorporates security requirements in acquisition planning and when
describing agency needs
* Requires contracting officers to adhere to Federal Information
* Requires contracting officers to include appropriate agency security
policy and requirements in IT acquisitions.
"The Councils recognize that IT security standards will continue to
evolve and that agency-specific policy and implementation will evolve
differently across the spectrum of federal agencies," the rule said.
"Agencies will customize IT security policies and implementations to
meet mission need[s]."
InfoSec News v2.0 - Coming Soon!