IMPROVING CYBERSECURITY RISK

MANAGEMENT IN FEDERAL ACQUISITION

Briefing for Federal Advisory Committee on Insurance (FACI)

4 November 2015

Emile Monette

Director

Government-wide Cyber Security, Resilience, and Risk

GSA Office of Government-wide Policy

emile.monette@gsa.gov 
Buyer Choices 

Affect Risk...

When a buyer 

purchases things 

from a seller with 

inadequate security 

built into its 

operations and 

deliverables 

(including its supply 

chains), bad things 

happen....

....and it harms us all.

2
3

Source: NIST SP 800-161 (2015)
Applying the NIST Risk 

Management Framework

Likelihood

(exploitability)

Criticality

Analysis

Vulnerability

Analysis

Threat

Analysis

Operations 

Requirements

(full SDLC)

Mission Requirements

(definition of critical 

mission threads)

Organization

Requirements/

Constraints

Accept, Reject, Transfer, 

Share, Mitigate Risk

Impact 

Analysis/Assessment

Frame Assess

Monitor

Monitor

Respond Respond

Assess

Frame

Baseline

Criticality

Frame: outsourcing a

mission function 

(buying something)

Assess: ???

Respond: 

requirements, 

solicitation, and 

contract 

Monitor: contract 

performance 

requirements
NATIONAL COUNTERINTELLIGENCE AND SECURITY CENTER 5

Assessing Risk

 Risk = ƒ ( threat, vulnerability, consequence)

 Risk = ƒ ( cost, schedule, performance) 

Security Integrity

Defense Science Board Report Resilient Military Systems and the Advanced Cyber Threat Feb 2013
The global supply 

chain and a high level 

of reliance on 

services... 

...results in lack of visibility for buyers...

...and leads to 

risk decisions 

being made 

without the 

benefit of 

available 

information.
...which is driving 

buyers to seek 

more detailed risk 

information about 

business partners.

 Buyers need information about all sellers and all tiers of 

the seller’s supply chain (but maybe not all the time): 

 How the goods and services they buy are developed, 

integrated and deployed; and 

 How sellers assure the integrity, security, resilience, and 

quality of those goods and services.
NATIONAL COUNTERINTELLIGENCE AND SECURITY CENTER 8

Things Are Not Always What They Seem...

Observable behavior of 

Multinational Firm Nefarious Intent ... ? ... or Business as Usual?

Tries to purchase US firms, create 

joint ventures

Seeking intellectual property for 

hostile activities

Secure market share, distribution, 

and access to technology and IP

Conduct business intelligence on 

competition

Acts as agents for foreign 

government

Plans and intentions of rivals; 

limitations of competing products

Access to systems or networks 

after equipment or software install

Foreign government access for 

collection and exploitation

Retain access to customer systems 

for service, maintenance, and 

license compliance monitoring

Fills key overseas positions with 

individuals of specific nationality

Vetted trusted insiders can 

facilitate intelligence activities

Executives with strong ties to firm 

to protect IP and business interests

Uses financial structure that is 

complex with limited transparency

Conceals financials to appear 

independent and fiscally sound

Global variation in taxes incentivize 

complex financial structures;

privately held firms limit details

Seeks contracts to supply US 

government

Firm may be trying to supply 

subverted products

US government is a large customer 

of products and services
Cybersecurity in Acquisition

 February, 2013, Executive Order 13636, Section 8(e):

Within 120 days of the date of this order, the Secretary of Defense and the 

Administrator of General Services, in consultation with the Secretary and the 

Federal Acquisition Regulatory Council, shall make recommendations to the 

President, through the Assistant to the President for Homeland Security and 

Counterterrorism and the Assistant to the President for Economic Affairs, on 

the feasibility, security benefits, and relative merits of incorporating security 

standards into acquisition planning and contract administration. The report 

shall address what steps can be taken to harmonize and make consistent 

existing procurement requirements related to cybersecurity.”

 Applicable to all acquisition planning, contract administration, 

and procurement activities.

 “What can we do in the Federal Acquisition System to improve 

cybersecurity outcomes?”

9
EO13636 Section 8(e) Report

“Ultimate goal of the recommendations is to strengthen the federal government’s 

cybersecurity by improving management of the people, processes, and technology 

affected by the Federal Acquisition System” 

 The Final Report, "Improving Cybersecurity and Resilience 

through Acquisition," was publicly released January 23, 2014: 

(http://gsa.gov/portal/content/176547) 

 Recommends six acquisition reforms:

I. Institute Baseline Cybersecurity Requirements as a Condition of Contract 

Award for Appropriate Acquisitions

II. Address Cybersecurity in Relevant Training

III. Develop Common Cybersecurity Definitions for Federal Acquisitions

IV. Institute a Federal Acquisition Cyber Risk Management Strategy

V. Include a Requirement to Purchase from Original Equipment 

Manufacturers, Their Authorized Resellers, or Other “Trusted” Sources, 

Whenever Available, in Appropriate Acquisitions

VI. Increase Government Accountability for Cyber Risk Management

10
2015 OMB Memo: “Improving 

Cybersecurity Protections in Federal 

Acquisitions”

 Draft memorandum published at https://policy.cio.gov

 Premise: Cybersecurity protections in Federal acquisitions can 

be further enhanced by performing increased “business due 

diligence.” 

• GSA shall provide agencies with risk information that encompasses 

data collected from voluntary contractor reporting, public records, 

publicly available and commercial subscription data, based on 

transparent, objective, and measurable risk indicators.

• Within 90 days, GSA to identify risk indicators and other core 

requirements for the shared service.
o Central government-wide service/solution that 

enables agencies to perform substantially improved 

“business due diligence” for ICT acquisitions.

o Provides capability to research, collect, assess, and 

share risk indicator data about a particular vendor, 

product, and/or service

o The BDDIS will store, maintain, and provide access to 

a central (government-wide) repository of risk 

information

GSA Office of Government-wide Policy – Cyber Security, Resilience, & Risk
DATA & 

INFORMATION 

INPUTS 

FUNCTIONS & 

OUTPUTS

GSA Office of Government-wide Policy – Cyber Security, Resilience, & Risk
DRIVERS & INFLUENCES – CYBERSECURITY IS URGENT PRIORITY

STAKEHOLDER & CUSTOMER OUTREACH – CONFIRMATION OF NEED 

• Issued RFI – received + 30 Responses 

• Extensive Outreach & Engagement: Qtly Software & Supply Chain 

Assurance Forum; RSA Conference; Open Group Forum; Defense Science 

Board Brief; Exostar; Cybersecurity Law Institute & Agencies (TSA, DoD ATL; 

State, Treasury, DHS, FBI, SSA, DoE, NASA, DNI + others)

• Federal Register Notice and Comments

• Interact & GSA.gov web content 

• Administration & Congressional Priority – e.g., Cyber CAP Goal, New Cyber 

Laws, Cybersprint, PPD-21; EO 13636 

• High-profile Breaches & Ever-increasing Threat

Need to Improve Cyber Protections in Acquisitions

• Inadequate Access to Due Diligence Data

• Risk Management Framework

• Private Sector & Insurance Industry - Alignment of Need & Approach

GSA Office of Government-wide Policy – Cyber Security, Resilience, & Risk
Due Diligence in Federal Acquisition

GSA piloting commercial “due diligence” service during fiscal 2016

 Results from 1st 60 companies assessed:

• 45% of contractors more risky than buyers said they could tolerate

• Top Overall Risks: Regional Stability (78%), Cybersecurity (52%), and 

Company Leadership (52%)

• Highest Risk: Technology companies (or their value-added resellers)

• Lowest risk: Accreditation bodies and access control companies

 Increased use of business due diligence information will improve 

agency risk decisions and enable greater confidence in 

contractors and deliverables.

“Vendor risk assessment is a smoke detector, not a fire detector.”

15
Three Steps to Implementation 

1. Baseline 

information 

collection 

requirements –

what are the right 

risk indicators?

2. Collection, 

analysis, and 

sharing of risk 

information 

3. Use the 

information –

specific use 

depends on end 

user risk 

tolerance; driven 

by mission 

priority and 

criticality

16
Questions?

Comments?

Concerns?