The U.S. General Services Administration (GSA) has released Revision 9 of its "IT Security Procedural Guide: Security and Privacy Requirements for IT Acquisition Efforts" (CIO-IT Security-09-48), effective January 15, 2025. This guide establishes security and privacy requirements for GSA IT acquisition contracts, encompassing externally and internally hosted information systems, Low Impact Software-as-a-Service (LiSaaS) systems, cloud information systems, mobile applications, and nonfederal systems handling Controlled Unclassified Information (CUI). The document ensures compliance with federal laws, regulations, and GSA policies, including FISMA of 2014, OMB Circular A-130, and NIST SP 800-53, Revision 5. It details essential security controls, assessment and authorization (A&A) activities, and continuous monitoring requirements. The guide is formatted for direct inclusion into statements of work or contracts, with specific instructions for tailoring requirements based on system type and impact level.
The U.S. General Services Administration (GSA) IT Security Procedural Guide, CIO-IT Security-19-95, Revision 2, outlines security engineering services provided by the OCISO ISE Division. It focuses on security architecture reviews for new and modified GSA information systems, ensuring compliance with GSA security requirements. The guide details a workflow for submitting and approving security architectures, including a checklist of considerations for system components, software, data flow, technical integration, and AWS-specific elements. It also covers ongoing security consulting and new technology review/approval processes, emphasizing early engagement with GSA Security Engineering. The document underscores the importance of security throughout the system lifecycle and adherence to federal and GSA IT security policies.
The General Services Administration (GSA), Federal Acquisition Services (FAS), Travel, Transportation and Logistics (TTL) is conducting market research through a Request for Information (RFI) to explore the feasibility of a supplemental lodging reservation service. This service would cater to eligible entities including state/local governments, Congressional offices, government contractors, non-profit organizations, and tribal groups. The RFI seeks industry input on a Statement of Objectives and specifically requests responses to capability evaluation questions detailed in Part II of the document to assess market readiness. Respondents are asked to provide business information in Part I, including company details, NAICS code, and small business designations. Part II focuses on capability survey questions covering pricing, fee collection, system security, 508 Compliance, FedRooms rate code management, reporting capabilities, reservation confirmation, and experience with Federal Authority to Operate (ATO) and IT security requirements. Participation in this voluntary survey does not guarantee future solicitations or contract awards, and the government will not reimburse for expenses. Responses must be submitted via email by December 23, 2025, 5:00 PM ET.