An official website of the United States government
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock
( )
or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
MV-2023-02 with supplements 1- 2
Date of latest supplement: May 14, 2024
MEMORANDUM FOR THE GSA ACQUISITION WORKFORCE
FROM AND DIGITALLY SIGNED BY:
Jeffrey A. Koses, Senior Procurement Executive, Office of Acquisition Policy
David A. Shive, Chief Information Officer, Office of GSA Information Technology
SUBJECT: Ensuring Only Approved Software is Acquired and Used at GSA
On this page
Issued May 14, 2024
On January 11, 2023, we issued Acquisition Letter MV-2023-02 to explain that Office of Management and Budget (OMB) Memo (M-22-18) required Federal agencies to use only software that complies with Government-specified secure software development practices.
While GSAM 511.170(d) already had a requirement for GSA IT to approve software before it could be acquired and used, the OMB memo necessitates GSA IT updating how it collects, reviews, retains, and monitors industry attestation information.
On May 24, 2023, we updated this Acquisition Letter to explain that GSA was extending the deadlines, including for collecting software attestations, while the Cybersecurity & Infrastructure Security Agency (CISA) and OMB finalized the Secure Software Development Attestation Common Form (hereafter referred to as the “Common Form”) and their Common Form repository.
On March 11, 2024, CISA and OMB released the Common Form and, on March 18, 2024, CISA’s repository went live.
These actions set a June 8, 2024, effective date for the OMB Policy.
Starting June 8, 2024, GSA will begin collecting Common Forms for new contracts (including micro-purchases) and the exercise of contract options, that include the use of software, regardless of whether or not the software is considered critical.
GSA IT will update its policy (or policies) by June 8, 2024, in accordance with OMB M-22-18 [PDF] and this AL, to help GSA’s workforce and to reflect, among other updates, GSA’s process for collecting, reviewing, retaining, and monitoring attestation information.
The Common Form for GSA’s use can be found on both the GSA Acquisition Portal Cyber-Supply Chain Risk Management (C-SCRM) page and GSA.gov’s Acquisition Policy Library and Resources page.
GSA will collect Common Forms directly from offerors and contractors, as needed. If a valid form has already been posted in the CISA’s repository, there is no need to obtain a separate attestation. [1]
Generally, as outlined in MV-2023-02, for GSA-funded acquisitions, Common Forms and Plans of Action & Milestones (POA&Ms) will be collected and reviewed, as necessary, through GSA’s existing IT Standards process.
With the exception of the changed date, paragraphs 3 through 7 MV-2023-02 (including Supplement 1) remain unchanged. Frequently Asked Questions (FAQs) will be posted to the C-SCRM Topic Page on the GSA Acquisition Portal.
As part of the C-SCRM course training curriculum, FCS 103 - Security Exclusions and Prohibitions, is now available in FAI CSOD. Completion of this course is mandatory for all acquisition certification holders.
All mandatory acquisition training, including additional C-SCRM courses, can be found on the GSA Acquisition Portal.
GSA’s Office of Government-wide Policy (OGP) has created a “Knowledge Check” course for this Acquisition Letter in FAI CSOD (search using “FCL-GSA-OGP0029”). This course is worth 1 continuous learning point (CLP). While the “Knowledge Check” course is not required, it is helpful to reinforce understanding.
[1] The existence of the CISA repository nullifies MV-2023-02’s requirement for GSA to “update GSA-administered indefinite delivery vehicles (IDVs)… to allow… contractors to provide attestations… at the base IDV contract level and make such information available to ordering activities” as industry may now submit forms to, and ordering agencies may access forms from, CISA’s repository directly.
Issued May 24, 2023
On May 2, 2023, GSA was notified that the Office of Management and Budget (OMB) is working on a process to extend the deadlines, including for collecting software attestations, contained in OMB Memo M-22-18. [PDF]
Accordingly, the dates reflected in GSA Acquisition Letter MV-2023-02, related to the updating of GSA IT policies and GSA’s collection of software attestations, are no longer applicable.
A second Supplement to MV-2023-02, including new deadlines, will be issued once OMB has issued additional information. Questions regarding this supplement may be directed to GSARPolicy@gsa.gov.
Issued January 11, 2023
The purpose is to highlight how current GSA acquisition policy and current GSA information technology policy work together to ensure only approved software (including products containing software) is acquired and used at GSA.
The combination of these policies allow GSA to respond to recent guidance issued by the Office of Management and Budget (OMB) as GSA, and other Federal agencies, wait for future Federal Acquisition Regulation (FAR) guidance.
Executive Order (EO) 14028, Improving the Nation’s Cybersecurity, directed the National Institute of Standards and Technology (NIST) to publish guidance on practices for software supply chain security. Additionally, the EO directed OMB to require agencies to comply with NIST’s applicable published guidance [1].
In response to this direction, OMB issued M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices. [PDF] In short, OMB M-22-18 states that Federal agencies must only use software that complies with Government-specified secure software development practices.
The General Services Acquisition Manual (GSAM) 511.170(d) already states that GSA information technology, including software, must be approved for use pursuant to GSA Order CIO 2160.1, GSA Information Technology (IT) Standards Profile (hereafter referred to as the “GSA Order”).
Specifically, the GSA Order states that no software [2] can be acquired (or used) until it has been through the IT Standards process and has been approved by the GSA Chief Technology Officer (CTO). Approved software is listed in GSA’s Enterprise Architecture Analytics & Reporting (GEAR) platform.
In order for software to become approved for GSA use, it must comply with the processes described in the GSA Order. Information Technology Coordination and Standards requirements are communicated to GSA acquisition teams and prospective offerors at General Services Administration Acquisition Regulation (GSAR) 511.170.
In accordance with OMB M-22-18 and this AL, GSA IT will update its policy (or polices), including the GSA Order, by June 12, 2023 to reflect, among other updates, GSA’s process for collecting, reviewing, retaining, and monitoring attestation information.
The FAR Council has opened a proposed rule (FAR case 2023-002 [3]) to implement section 4(n) of EO 14028. This rule will also focus on requirements outlined in OMB M- 22-18.
Once the rule is finalized, relevant GSA acquisition policy, and the referenced GSA Order, may be updated to further implement the FAR rule.
As GSA waits for the referenced FAR rule to be issued, all GSA contracting activities, including lease contracting activities, are reminded of the requirements for the procurement and use of approved and unapproved software.
For existing contracts (including applicable micro-purchases and leases) that include the use of software, GSA IT will provide an internally accessible list of those softwares and will start collecting attestations by June 12, 2023, working with the appropriate contracting officers, as necessary, as part of their IT Standards Process that will be clarified in the GSA Order, and in accordance with OMB M-22-18.
If GSA IT previously approved a software, but no longer approves the software (due to an expired pilot, or newer federal prohibitions, for example), any future period of performance (e.g., option year, extension, task order) cannot be exercised or issued and the requirement must be re-procured.
For any GSA contract [4] with requirements (or that may include requirements) for the use of software, acquisition teams must incorporate planning that includes the following in their applicable acquisition activities.
For requirements covered by the GSA Order, acquisition teams must do the following as early in the acquisition process as possible:
Acquisition teams are also encouraged to recommend potential and interested cloud vendors to pursue FedRAMP compliance when possible.
GSA contracting activities must update GSA-administered indefinite delivery vehicles (IDVs) (e.g., Federal Supply Schedule, Government-wide Acquisition Contracts, Multi- Agency Contracts (MACs)) to allow, but not require, contractors to provide attestations [7], responsive to the requirements of OMB M-22-18, at the base IDV contract level and make such information available to ordering activities to the extent possible.
As previously discussed, once the FAR rule is finalized, relevant GSA acquisition policy specific to GSA-administered IDVs may be updated to further implement the FAR rule.
For assisted acquisitions, GSA contracting activities must follow the policy of the requesting agency.
The requirements of the GSA Order are applicable to micro-purchases and the use of the GSA Purchase Card.
GSA’s Office of Government-wide Policy (OGP), with help from GSA’s Office of the Chief Information Security Officer (CISO), is designing and developing training on ensuring understanding and compliance with the GSA policies outlined in this AL.
Once the requirements of OMB M-22-18 are incorporated into the FAR, GSA’s associated training will be adapted to the final FAR rule as applicable and made available to the workforce via FAI CSOD.
For any general policy questions regarding this AL, questions may be directed to GSARPolicy@gsa.gov.
For any specific questions regarding GSA IT Information Standards, questions must be directed to it-standards@gsa.gov.
[1] The NIST Secure Software Development Framework (SSDF), SP 800-218 and the NIST Software Supply Chain Security Guidance [PDF].
[2] The GSA Order further explains and defines the information technologies within scope of the policy, including applicable software, cloud services, and products containing software.
[3] Open FAR Cases Report. [PDF]
[4] Including applicable micro-purchases and leases.
[5] Review the FedRAMP Marketplace for a list of FedRAMP authorized products, solutions, and providers.
[6] The GSA IT Standards process and associated security review will include collecting applicable attestations responsive to the requirements of OMB M-22-18.
[7] Attestations at the IDV level must utilize the forthcoming Cybersecurity & Infrastructure Security Agency (CISA) attestation common form (if not already publicly posted) and must not include Plan of Action & Milestones (POA&M) or Software Bill of Material (SBOM) information. The ordering agency is responsible for complying with OMB M-22-18.
On January 11, 2023, GSA’s Senior Procurement Executive Jeff Koses and GSA’s Chief Information Officer David Shive jointly signed Acquisition Letter MV-23-02, Ensuring Only Approved Software is Acquired and Used at GSA.
MV-23-02 reminds GSA contracting activities of current GSA acquisition policy and current GSA information technology policy that must be followed to ensure only approved software is procured and used at GSA.
GSA’s acquisition regulations (GSAM 511.170(d)) require GSA’s Information Technology (IT) Office to approve new software before its use at GSA. To comply with Executive Order 14028 and OMB Memorandum M-22-18 [PDF], which require federal agencies to only use software that complies with Government-specified secure software development practices, GSA IT will update its processes to approve software including requiring vendor attestations. GSA IT anticipates issuing an updated attestation process by June 12, 2023.
Under GSA’s implementation, GSA will begin collecting attestation letters as part of pre-award and post-award contract deliverables in mid-June 2023 for all impacted software, regardless of whether or not the software is considered critical. When collecting attestations, GSA anticipates using the Cybersecurity & Infrastructure Secure Agency (CISA) Common Form once the form is provided for agency use. GSA expects the form to be ready before June 2023, and GSA will help to communicate and distribute the form when it is available. When available, GSA will provide a link to the CISA form from the Acquisition Policy Library and Resources page on GSA.gov under the “Resources” section.
Contractors providing GSA with a cloud-based solution are encouraged to work with the Federal Risk and Authorization Management Program (FedRAMP). The FedRAMP approval process will streamline the GSA IT Standards Process allowing for a timely contract start. GSA also anticipates that leveraging FedRAMP will ensure and streamline compliance with requirements of OMB Memo M-22-18 in the future.
Contractors supporting GSA on-premises (non-cloud) Federal Information Systems will also be impacted. Once the CISA Common Form is issued, contractors should complete the form in accordance with any further CISA/OMB instructions or the pending instructions from GSA IT.
If you use a GSA contract vehicle to sell to other agencies, (such as a Federal Supply Schedule, GWAC, OASIS, etc), for now GSA will allow, but not require, you to attest at the contract level so you don’t have to do so, repetitively, for each and every order. GSA anticipates that a forthcoming FAR rule will provide definitive instructions for the requirements of the attestation at the contract level.
Error, The Per Diem API is not responding. Please try again later.
No results could be found for the location you've entered.
Rates for Alaska, Hawaii, and U.S. territories and possessions are set by the Department of Defense.
Rates for foreign countries are set by the Department of State.
Rates are available between 10/1/2022 and 09/30/2025.
The End Date of your trip can not occur before the Start Date.
Traveler reimbursement is based on the location of the work activities and not the accommodations, unless lodging is not available at the work activity, then the agency may authorize the rate where lodging is obtained.
Unless otherwise specified, the per diem locality is defined as "all locations within, or entirely surrounded by, the corporate limits of the key city, including independent entities located within those boundaries."
Per diem localities with county definitions shall include"all locations within, or entirely surrounded by, the corporate limits of the key city as well as the boundaries of the listed counties, including independent entities located within the boundaries of the key city and the listed counties (unless otherwise listed separately)."
When a military installation or Government - related facility(whether or not specifically named) is located partially within more than one city or county boundary, the applicable per diem rate for the entire installation or facility is the higher of the rates which apply to the cities and / or counties, even though part(s) of such activities may be located outside the defined per diem locality.
An SBA program that helps provide a level playing field for small businesses owned by socially and economically disadvantaged people or entities that meet the following eligibility requirements:
See Title 13 Part 124 of the Code of Federal Regulations for more information.
A multiple-award IDIQ governmentwide acquisition contract offering complete and flexible IT solutions worldwide. A best-in-class GWAC and preferred governmentwide solution, Alliant 2 offers:
It provides best-value IT solutions to federal agencies, while strengthening chances in federal contracting for small businesses through subcontracting.
An agreement established by a government buyer with a Multiple Award Schedule contractor to fill repetitive needs for supplies or services.
Types of funds to use on specific expenses.
The work done to make a structure or system ready for use or to bring a construction or development project to a completed state.
Negotiated firm-fixed pricing on airline seats for official government travel. The locked-in ticket prices for the fiscal year save federal agencies time and money. Federal employees enjoy flexibility to change their plans without incurring penalties or additional costs. All negotiated rates have:
Use the CPP search tool to find current fares.
From 5 USC 5701(6), "continental United States" means the several states and the District of Columbia, but does not include Alaska or Hawaii.
A space where individuals work independently or co-work collaboratively in a shared office. The work environment is similar to a typical office, usually inclusive of office equipment and amenities. Typical features of co-working facilities include work spaces, wireless internet, communal printer/copier/fax, shared kitchens, restrooms and open seating areas. May also be referred to as a “shared office.”
A system that is bought from a commercial vendor to solve a particular problem, as opposed to one that a vendor custom builds.
An employee who negotiates and awards contracts with vendors and who has the sole authority to change, alter or modify a contract.
An employee whose duties are to develop proper requirements and ensure contractors meet the commitments during contract administration, including the timeliness and delivery of quality goods and services as required by the contract.
A request of GSA where a federal agency retains and manages all aspects of the procurement process and is able to work with the selected vendor after award.
An SBA program that gives preferential consideration for certain government contracts to businesses that meet the following eligibility requirements:
See Title 13 Part 127 Subpart B of the Code of Federal Regulations for more information.
The primary regulation for federal agencies to use when buying supplies and services with funds from Congress.
Use acquisition.gov to browse FAR parts or subparts or download the full FAR in various formats.
The travel and relocation policy for all federal civilian employees and others authorized to travel at government expense.
A program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment.
A GSA business line that provides safe, reliable, low-cost vehicle solutions for federal agency customers and eligible entities. Offerings include:
A charge card for U.S. government personnel to use when paying for fuel and maintenance of GSA Fleet vehicles. Find out where the Fleet card is accepted, how to use it and more.
A Department of Homeland Security program that allows members to use expedited lanes at U.S. airports and when crossing international borders by air, land and sea.
A charge card for certain U.S. Government employees to use when buying mission-related supplies or services using simplified acquisition procedures, when applicable, and when the total cost does not exceed micro-purchase thresholds.
A charge card for U.S. government personnel to use when paying for reimbursable expenses while on official travel. Visit smartpay.gsa.gov for more.
A vehicle used to perform an agency’s mission(s), as authorized by the agency.
Pre-competed, multiple-award, indefinite delivery, indefinite quantity contracts that agencies can use to buy total IT solutions more efficiently and economically.
A ceremony marking the official start of a new construction project, typically involving driving shovels into ground at the site.
An online shopping and ordering system at gsaadvantage.gov that provides access for federal government employees and in some cases, state and local entities, to purchase from thousands of contractors offering millions of supplies and services.
An online auction site at gsaauctions.gov that allows the general public to bid on and buy excess federal personal property assets such as:
Real property for which GSA is responsible. It can be either federally owned or leased from a public or private property owner.
An SBA program that gives preferential consideration for certain government contracts to business that meet the following eligibility requirements:
See Title 13 Part 126 Subpart B of the Code of Federal Regulations for more information.
A type of contract when the quantity of supplies or services, above a specified minimum, the government will require is not known. IDIQs help streamline the contract process and speed service delivery.
A fee paid by businesses who are awarded contracts under Multiple Award Schedule to cover GSA’s cost of operating the program. The fee is a fixed percentage of reported sales under MAS contracts that contractors pay within 30 calendar days following the completion of each quarter.
A law that provides $3.375 billion for us to:
This includes $2.15 billion for low embodied carbon materials in construction projects, $975 million to support emerging and sustainable technologies, and $250 million for measures to convert more buildings into High Performance Buildings.
An investment in our nation’s infrastructure and competitiveness. The law provides funding for LPOE modernization projects that will create new good-paying jobs, bolster safety and security, and make our economy more resilient to supply chain challenges.
A written agreement entered into between two federal agencies, or major organizational units within an agency, which specifies the goods to be furnished or tasks to be accomplished by one agency (the servicing agency) in support of the other (the requesting agency).
A facility, also known as a border station, that provides controlled entry into or departure from the United States for persons or materials. It houses the U.S. Customs and Border Protection and other federal inspection agencies responsible for the enforcement of federal laws related to entering into or departing from the U.S.
An employee who is responsible for preparing, negotiating, awarding and monitoring compliance of lease agreements.
Criteria used to select the technically acceptable proposal with the lowest evaluated price. Solicitations must specify that award will be made on the basis of the lowest evaluated price of proposals meeting or exceeding the acceptability standards for non-cost factors.
The rate of reimbursement for driving a privately owned vehicle when your agency authorizes it. Current rates are at gsa.gov/mileage.
Long-term governmentwide contracts with commercial firms providing federal, state, and local government buyers access to more than 11 million commercial products and services at volume discount pricing. Also called Schedules or Federal Supply Schedules.
The standard federal agencies use to classify business establishments for the purpose of collecting, analyzing, and publishing statistical data related to the U.S. business economy.
A family of six separate governmentwide multiple award, IDIQ contracts for management and advisory, facilities, technical and engineering, logistics, intelligence services, research and development, environmental, and enterprise solutions.
A formal, signed agreement between GSA’s Public Buildings Service and a federal agency for a specific space assignment.
Services performed under a contract with a federal agency that include:
The per day rates for the lower 48 continental United States, which federal employees are reimbursed for expenses incurred while on official travel. Per diem includes three allowances:
An identification card that allows credentialed government personal to access facilities, computers, or information systems. May also be referred to as HSPD-12 card, LincPass, Smart Card, or CAC.
Furniture and equipment such as appliances, wall hangings, technological devices, and the relocation expenses for such property.
Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. Get our agency's privacy policies and practices as they apply to our employees, contractors, and clients.
You should only drive a privately owned vehicle for official travel after your agency evaluates the use of:
When your agency has determined a POV to be the most advantageous method of transportation, you are authorized reimbursement for mileage and some additional allowances (parking, bridge, road and tunnel fees, etc.).
Approvals from GSA’s congressional authorizing committees, the U.S. Senate Committee on Environment and Public Works and the U.S. House Committee on Transportation and Infrastructure, for proposed capital and leasing projects that require funding over an annually established threshold.
Region 1 (New England): Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont
Region 2 (Northeast and Caribbean): Northern New Jersey, New York, Puerto Rico, U.S. Virgin Islands
Region 3 (Mid-Atlantic): Delaware, parts of Maryland, Southern New Jersey, Pennsylvania, parts of Virginia, West Virginia
Region 4 (Southeast Sunbelt): Alabama, Florida, Georgia, Kentucky, Mississippi, North Carolina, South Carolina, Tennessee
Region 5 (Great Lakes): Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin
Region 6 (Heartland): Iowa, Kansas, Missouri, Nebraska
Region 7 (Greater Southwest): Arkansas, Louisiana, New Mexico, Oklahoma, Texas
Region 8 (Rocky Mountain): Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming
Region 9 (Pacific Rim): Arizona, California, Hawaii, Nevada
Region 10 (Northwest Arctic): Alaska, Idaho, Oregon, Washington
Region 11 (National Capital): Washington, D.C., area including parts of Maryland and Virginia
Formal agreements between GSA and a federal agency customer where GSA agrees to provide goods, services, or both, and the federal agency agrees to reimburse GSA’s direct and indirect costs. The customer portal for RWA information is called eRETA at extportal.pbs.gsa.gov.
A document used in negotiated procurements to communicate government requirements to prospective contractors (firms holding Multiple Award Schedule contracts) and to solicit proposals (offers) from them.
A document used to communicate government requirements, but which do not solicit binding offers. Quotations submitted in response are not offers. The Multiple Award Schedule order is the offer, and then the contractor can do something to show acceptance, like ordering supplies or contacting subcontractors.
An SBA program that gives preferential consideration for certain government contracts to businesses that meet the following eligibility requirements:
See Title 13 Part 128 Subpart B of the Code of Federal Regulations for more information.
An SBA designation for businesses that meet size standards set for each NAICS code. Most manufacturing companies with 500 employees or fewer, and most non-manufacturing businesses with average annual receipts under $7.5 million, will qualify as a small business.
See Title 13 Part 121.201 of the Code of Federal Regulations for more information.
To improve and stimulate small business utilization, we award contracts to businesses that are owned and controlled by socially and economically disadvantaged individuals. We have contracting assistance for:
A Small Business Administration program that gives preferential consideration for certain government contracts to business that meet the following eligibility requirements:
See Title 13 Section 124.1001 of the Code of Federal Regulations for more information.
The basis for the lease negotiation process, which becomes part of the lease. SFOs include the information necessary to enable prospective offerors to prepare proposals. See SFO minimum requirements.
Specific supply and service subcategories within our Multiple Award Schedule. For the Information Technology Category, a SIN might be new equipment or cloud services.
An online system at sam.gov, which the U.S. Government uses to consolidate acquisition and award systems for use by contractors wishing to do business with the federal government. Formerly known as FBO.gov, all contracting opportunities valued over $25,000 are posted at sam.gov.
When you use a government purchase card, such as the "GSA SmartPay" travel card for business travel, your lodging and rental car costs may be exempt from state sales tax. Individually billed account travel cards are not tax exempt in all states. Search for exemption status, forms and important information.
The finishes and fixtures federal agency tenants select that take a space from a shell condition to a finished, usable condition and compliant with all applicable building codes and standards.
A statute that applies to all Multiple Award Schedule contracts, unless otherwise stated in the solicitation or contract, which requires contractors to sell to the U.S. Government only products that are manufactured or “substantially transformed” in the U.S. or a TAA-designated country.
Vendors report transactional data — information generated when the government purchases goods or services from a vendor — to help us make federal government buying more effective.
See our TDR page for which SINs are eligible and which line-item data to submit.
A unique number required to do business with the federal government.
An indicator of how efficiently a federal agency is currently using space, it is traditionally calculated by dividing the usable square feet of the space, by the number of personnel who occupy the space.
A Small Business Administration program that gives preferential consideration for certain government contracts to businesses that meet the following eligibility requirements:
A governmentwide acquisition contract exclusively for service-disabled veteran-owned small businesses to sell IT services such as:
The amount of solid waste, such as trash or garbage, construction and demolition waste, and hazardous waste, that is reused, recycled or composted instead of being put in a landfill or burned.
A GSA program designed to promote recycling and reuse of solid waste.
A Small Business Administration program that gives preferential consideration for certain government contracts to businesses that meet the following eligibility requirements:
See Title 13 Part 127 Subpart B of the Code of Federal Regulations for more information.
U.S. General Services Administration