Loading story…
The U.S. General Services Administration (GSA) has launched OneGov, a new initiative to centralize federal IT procurement, treating the government as a single enterprise buyer. This shift aims to streamline purchasing, secure better pricing, and standardize security, but raises concerns about congressional oversight, competition, and small business participation. The long-term impact on oversight, competition, and agency budgets remains uncertain as the federal marketplace undergoes this significant transformation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Nextgov reported that the General Services Administration is preparing a draft artificial intelligence acquisition rule for inclusion in the General Services Administration Acquisition Regulation. The effort is intended to prioritize firm fixed-price procurement and simplify commercial item acquisition for AI and IT software.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
nextgov.com
Open sourcereversinglabs.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The General Services Administration and the National Institute of Standards and Technology launched a partnership to create standardized methods for evaluating AI models and services before they are used in federal operations, aiming to give agencies common benchmarks, testing procedures, and onboarding resources through NIST’s Center for AI Standards and Innovation. The effort is designed to support broader federal AI adoption, including USAi.gov and GSA’s marketplace strategy, while the White House has separately pushed agencies to buy large language models that are truthful, neutral, and free from bias under OMB memo `M-26-04`. At the same time, the administration’s emerging AI governance framework has drawn criticism from legal analysts, trade groups, and civil liberties advocates. GSA’s draft procurement clause `GSAR 552.239-7001` has been criticized as overly broad for restricting vendor use of government data, imposing portability and evaluation rights, extending compliance obligations across the AI supply chain, and requiring “American AI Systems,” while industry groups warn it could create surveillance and profiling risks, clash with vendor terms, weaken intellectual property protections, and deter commercial providers from serving the government. Analysts have also warned that the White House bias memo relies too heavily on vendor self-assessments and lacks independent verification, leaving gaps in accountability as lawmakers simultaneously advance stricter AI safeguards elsewhere, including a Senate bill to bar minors from interacting with AI companions and to require age checks and disclosure rules for such systems.
Jun 29, 2026
CISA is considering hiring a contractor to manage enterprise purchases of cybersecurity software and related tools through a single acquisition mechanism, a move that would cover roughly **$600 million** in annual spending and could reach **$6 billion** over the life of a contract. The agency launched the effort through a sources sought notice issued on August 12 and is conducting market research and acquisition planning with the General Services Administration’s Assisted Acquisition Services team. The contemplated support would include procurement assistance, enterprise license management, software asset management, vendor management, analytics, and strategic buying advisory services. The plan is tied to CISA’s shift away from the Continuous Diagnostics and Mitigation program’s approved product list toward a new **Cyber Product List** and **Technical Capability Catalog**, which would guide future enterprise cyber software procurements across the agency.
Aug 19, 2026
The **NSA** published *Zero Trust Implementation Guidelines* **Phase One** and **Phase Two**, expanding its series beyond earlier *Primer* and *Discovery Phase* materials to provide more actionable, task-based direction aligned to the DoD target-level maturity model. Phase One outlines **36 activities** intended to establish conditions for **30 zero trust capabilities**, while Phase Two defines **41 activities** to begin integrating core zero trust solutions and enable **34 additional capabilities**, with a modular approach intended to let organizations tailor adoption based on maturity and constraints. Separately, the **General Services Administration (GSA)** is tightening federal supply-chain cybersecurity expectations by issuing an IT security procedural guide (CIO-IT Security-21-112 Rev. 1) that imposes **CMMC-like** requirements on certain **new contracts involving CUI**, including implementation of **NIST SP 800-171** and selected **800-172** controls. The guide identifies **eight blocking requirements** (including **MFA**, **encryption of CUI in transit and at rest**, **vulnerability scanning/remediation**, and removal of **end-of-life components**) and requires **independent assessments** via FedRAMP third-party organizations or GSA-approved assessors, though GSA has not published assessor approval criteria—creating potential uncertainty for contractors; a separate GSA acquisition discussion on AI purchasing emphasizes flexibility, cost savings, and responsible use but does not materially add to the zero trust or contractor-control policy details.
Jun 29, 2026