The GSA has released a new IT security procedural guide for contractors, aligning with NIST requirements. This guide outlines the verification process for protecting controlled and classified information, offering valuable examples for defense contractors. Despite its complexity, it highlights the straightforward nature of CMMC compared to GSA's approach, which follows the NIST Risk Management Framework.
In January 2025, significant news emerged for contractors working with the General Services Administration (GSA). The GSA released a new document, CIO-IT-Security-21-12 Revision 1, which serves as an IT security procedural guide aimed at protecting controlled and classified information in non-federal systems. This guide outlines the requirements for GSA contractors and vendors to implement NIST standards, specifically NIST SP 800-171 Revision 3 and NIST SP 800-172 Revision 3.
The newly released guide is a comprehensive 45-page document detailing the verification process for GSA contractors. It is important to note that there has been little public discussion or media coverage regarding this release, making it a relatively unknown but crucial development for contractors in the defense sector.
The GSA's guide does not come with any associated rule-making or articles, which may contribute to its obscurity. However, it provides a structured approach to verifying compliance with NIST requirements. The document includes various phases, sub-phases, procedures, and external assessments that contractors must navigate to ensure they meet the necessary security standards.
Even if you are not a GSA contractor, this guide is still relevant. It offers valuable examples of what a System Security Plan (SSP) entry might look like for both fully satisfied and partially satisfied controls. This is particularly beneficial since the Department of Defense (DoD) rarely provides such examples, making the GSA's document a useful resource for understanding compliance expectations.
One of the notable aspects of the GSA's approach is its alignment with the NIST Risk Management Framework (RMF). The five phases outlined in the GSA document—prepare, document, assess, authorize, and monitor—mirror the steps of the RMF process. This structure may seem complex compared to the Cybersecurity Maturity Model Certification (CMMC), which is generally perceived as more straightforward.
Industry experts have noted that the GSA's approach appears to take cues from CMMC 3.0, which is currently in development. This connection was highlighted during discussions among professionals in the defense contracting space, where the GSA's guidelines were compared to CMMC standards. The unexpected release of this document has raised questions about its implications for businesses and their compliance strategies moving forward.
The GSA's release of CIO-IT-Security-21-12 Revision 1 marks a significant step in establishing security protocols for contractors handling controlled and classified information. While the document may seem daunting, it provides essential guidance and examples that can aid contractors in navigating compliance with NIST requirements. As the landscape of cybersecurity continues to evolve, understanding these guidelines will be crucial for contractors aiming to protect sensitive information effectively.
