Why GSA’s OneGov Strategy May Face Implementation Hurdles

A White House effort to streamline federal information technology purchasing through the General Services Administration’s new “OneGov” strategy may help further centralize buying power and improve cybersecurity through standardized contracts. Procurement experts warn it could also clash with the administration’s broader push to deregulate and strip down longstanding acquisition rules.

GSA said in a recent statement that OneGov will give agencies easier access to IT tools with standardized terms and pricing and offer original equipment manufacturers a more direct and predictable engagement model. Early deals include a major agreement with Google that provides a temporary 71% discount on Google Workspace for federal agencies, and a 70% discount from Adobe on its Paperless Government Solution.

GSA has said the OneGov strategy “will evolve over time” and expand into areas such as hardware, platforms, infrastructure and cybersecurity services.

Experts told Information Security Media Group they are “cautiously optimistic” that future phases of the OneGov strategy could expand access to stronger, lower-cost cybersecurity tools across government, as GSA has pledged. Some raised concerns that the approach may sideline smaller vendors and undercut ongoing efforts to favor more flexible, nontraditional procurement models that avoid centralized structures altogether.

Alan Chvotkin, a federal procurement expert and partner at Centre Law and Consulting, said standardizing purchase terms across government buys could yield major benefits in consistency, reduce compliance burdens for agencies and contractors and potentially lower industry costs. But GSA’s influence has its limits, he said, especially when it comes to agency-specific cybersecurity requirements.

“I don’t believe it is GSA’s expectation that it will be able to force buying activities into accepting GSA-negotiated terms and conditions in lieu of every agency-specific requirement,” Chvotkin told Information Security Media Group. “For example, will GSA’s cyber terms and conditions supplant or exclude DOD’s CMMC requirements? Or another agency’s statutory mandate? I doubt it.”

The OneGov strategy was launched following an April 16 White House directive calling for a sweeping overhaul of federal procurement policy to boost competition, cut costs and streamline acquisition rules. Kevin Rhodes, senior advisor at the Office of Management and Budget, said in a statement that a planned rewrite of the Federal Acquisition Regulation “will reduce more than 40 years of bureaucratic buildup that will unleash our procurement system with generational change and results.”

Several analysts warned the OneGov strategy could overshadow the president’s federal procurement directive and a separate executive order aimed at streamlining defense acquisitions. That order prioritizes commercial solutions offerings and Other Transaction Authority, two procurement methods not governed by the FAR.

A key test of the OneGov strategy’s effectiveness in improving cybersecurity will be whether it streamlines the slow, often dysfunctional process vendors face when seeking approval to operate in Federal Risk and Authorization Management Program environments, Greg Anderson said, CEO of DefectDojo and a former Pentagon penetration tester. Anderson told ISMG that “the process to acquire ATO status has essentially ground to a halt,” forcing vendors to partner with third parties that already hold Authorization to Operate credentials.

“If the ATO status gets revised from its fundamentally broken state, this will be a huge win for vendors, taxpayers, government employees and the federal government itself, provided proper due diligence procedures are still in place,” Anderson said, adding that he remains concerned about due diligence and noting how close the federal government’s Common Vulnerabilities and Exposures program came to shutting down (see: Cybersecurity Alarms Sound Over Loss of CVE Program Funding).

“The big question is this: What does the government do if a smaller vendor that has become essential suddenly goes out of business?” he added.

While OneGov could help simplify procurement, it also raises questions about how a direct-to-manufacturer model will work in complex, multi-vendor environments like critical infrastructure.

Original equipment manufacturers can be effective when a single-vendor solution is feasible, but most critical infrastructure environments rely on multiple vendors – even within the same facility – Dan Gunter said, CEO of cybersecurity firm Insane Cyber and former cyber warfare officer for the U.S. Air Force. While OEMs may know their own technology best, Gunter said the more practical approach often reflects the reality that plant environments are heterogeneous.

“OEMs can be driven to maximize their contract values when a heterogeneous solution may be ideal,” he said. “An asset owner would potentially need to work with all of their OEMs individually rather than rely on a trusted, agnostic vendor to manage those relationships.”

Analysts warned that the OneGov strategy could push the federal government to favor products from large, contracted software vendors over more advanced alternatives. Critical infrastructure and sensitive mission systems – often tied to operational technology and legacy platforms – may also face “integration hurdles,” said Felipe Fernandez, chief technology officer at Fortinet Federal.

Critical infrastructure IT environments demand “an understanding of mission context and systemic risk,” Fernandez said. While OEMs will “certainly continue to provide supporting technology,” he added, “the environment calls for more than just products.”

“The imperative for agencies then would be to not totally disregard value-added partnership expertise in the technology selection process,” Fernandez told ISMG.

GSA did not respond to requests for comment on how the OneGov strategy might function within the already crowded landscape of federal regulatory procurement, or how it would align with existing cybersecurity frameworks. The White House also did not respond to a request for comment.