On September 30, 2005, the Federal Register issued an interim rule that amends the Federal Acquisition Regulation (“FAR”) in order “to implement the Information Technology (IT) Security provisions of the Federal Information Security Management Act of 2002 (FISMA).”
Likely the most important proposed change would be the addition of the Federal Information Processing Standards Publications (“FIPS PUBS”) to the list of documents cited in FAR 11.102. The documents mentioned in that provision are ones to be relied on for guidance in standardizing agency programs. Among other things, the interim rule would also amend FAR 39.101 to read: “In acquiring information technology, agencies shall include the appropriate information technology security policies and requirements.”
According to the Federal Register, FISMA’s requirements will perhaps affect small businesses the most. The Supplementary Information to the rule states that “[a]lthough the FAR rule will itself have no direct impact on small business concerns, the subsequent supplemental policy-making at the agency level may have some impact on these entities. Since FISMA requires that agencies establish IT security policies that are commensurate with agency risk and potential for harm and that meet certain minimum requirements, the real implementation of this will occur at the agency level.”
The Federal Register states that all comments on the interim rule must be submitted “to the FAR Secretariat on or before November 29, 2005 to be considered in the formulation of the final rule.” Identify all such comments by FAC 2005-06, FAR case 2004-018. In addition to other methods, comments may be submitted by sending them to http://www.regulations.gov.
This update is published by Venable LLP. Venable publications are not intended to provide legal advice or opinion. Such advice may only be given when related to specific fact situations. © Copyright by Venable LLP 2005.