US Federal Guidance and Contracting Shifts on Zero Trust and Contractor Cybersecurity Controls

The NSA published Zero Trust Implementation Guidelines Phase One and Phase Two, expanding its series beyond earlier Primer and Discovery Phase materials to provide more actionable, task-based direction aligned to the DoD target-level maturity model. Phase One outlines 36 activities intended to establish conditions for 30 zero trust capabilities, while Phase Two defines 41 activities to begin integrating core zero trust solutions and enable 34 additional capabilities, with a modular approach intended to let organizations tailor adoption based on maturity and constraints.

Separately, the General Services Administration (GSA) is tightening federal supply-chain cybersecurity expectations by issuing an IT security procedural guide (CIO-IT Security-21-112 Rev. 1) that imposes CMMC-like requirements on certain new contracts involving CUI, including implementation of NIST SP 800-171 and selected 800-172 controls. The guide identifies eight blocking requirements (including MFA, encryption of CUI in transit and at rest, vulnerability scanning/remediation, and removal of end-of-life components) and requires independent assessments via FedRAMP third-party organizations or GSA-approved assessors, though GSA has not published assessor approval criteria—creating potential uncertainty for contractors; a separate GSA acquisition discussion on AI purchasing emphasizes flexibility, cost savings, and responsible use but does not materially add to the zero trust or contractor-control policy details.