Labor & Employment Law Daily Wrap Up, FEDERAL REGULATIONS—FAR proposed rule includes workforce requirements for IT & cybersecurity contracts, (Jan 17, 2025)

By George M. Gullo, J.D.

Proposed amendments to the Federal Acquisition Regulation would incorporate a framework to describe workforce knowledge and skill requirements for information technology and cybersecurity services contracts.

Executive Order 13870, America’s Cybersecurity Workforce, requires federal agencies to incorporate, into contracts for IT and cybersecurity support services, the NICE Workforce Framework for Cybersecurity (NICE Framework), National Institute of Standards and Technology Special Publication 800–181, and additional implementing tools that describe workforce knowledge and skill requirements.

National resource. The NICE Framework is a nationally focused resource that categorizes and describes cybersecurity work. The NICE Framework establishes a common language that defines and categorizes cybersecurity competency areas and work roles, including the knowledge and skills needed to complete tasks in those roles. It serves as a resource to develop and support an effective cybersecurity workforce that enables consistent communication for education, training, and workforce development. These FAR amendments are intended to ensure that when acquiring IT or cybersecurity support services agencies align the workforce with the NICE Framework.

Requirements. The rule would thus implement requirements for agencies procuring IT support and cybersecurity support services to provide:

• workforce tasks, knowledge, skills, and work roles that align with the NICE Framework in their acquisition plans as a security consideration;

• a description, in the requirements documents, of the cybersecurity workforce tasks, knowledge, skills, and work roles to align with the NICE Framework; and,

• requirements for offers, quotes, and reporting requirements (e.g., contract deliverables) to align with the NICE Framework.

Implementation. To implement these requirements in the FAR (48 C.F.R.), the rule would amend FAR 2.101 to add a definition for “cybersecurity” and the “NICE Workforce Framework for Cybersecurity (NICE Framework).” FAR 7.105 would be amended to require that agency acquisition plans for the acquisition of IT support services or cybersecurity support services describe workforce functions that align with the NICE Framework. The rule would similarly revise FAR 11.002 and also direct agencies to require offers, quotes, and reporting requirements that align with the NICE Framework, and FAR 12.202 would be amended to require, for the acquisition of commercial products and services, compliance with the direction at FAR 11.002 for incorporating the NICE Framework in requirements documents. Finally, the rule would amend FAR 39.104 to reference the direction at FAR 11.002 for incorporating the NICE Framework in requirements documents. Comments to this proposed rule, identified by FAR Case 2019-014, are due by March 4, 2025.

News: FederalRegulations AgencyNews WhiteHouseNews GovernmentContracts Privacy PublicEmployees