What the GSA lane involves
- We review the CUI, cybersecurity, and assessment requirements incorporated into your GSA contract or order and map them against GSA's procedural guidance (CIO-IT Security-21-112, Rev. 1).
- Implementation follows the 800-171 revision GSA's process specifies, and the GSA-defined parameter values go into an ODP register you can defend.
- The requirements GSA treats as showstoppers, the ones that block authorization, are identified and remediated first so the package doesn't stall at review.
- The authorization package (SSP, POA&M, and objective-level evidence) is assembled in the structure GSA reviewers expect.
- After authorization, continuous monitoring (evidence refresh, control validation, and change reporting) runs under managed compliance so the authorization stays defensible.
GSA moved early: its current guidance already uses NIST SP 800-171 Rev. 3 with agency-defined parameters. If GSA work is in your pipeline, the Rev. 3 transition is something to put on your schedule now.
Questions contractors ask us
What does GSA actually require of contractor systems handling CUI?
GSA's IT security procedural guidance for CUI on nonfederal systems (CIO-IT Security-21-112, Rev. 1) defines a lifecycle built on NIST SP 800-171. It includes Rev. 3 requirements with GSA-defined ODP values, designated 'showstopper' requirements, an authorization decision, and continuous monitoring afterward. For any given order, the language in your contract and the process your GSA authorizing officials run are what control.
How is GSA authorization different from a CMMC assessment?
A CMMC Level 2 certification is a point-in-time assessment conducted by a C3PAO against the DoD's methodology. GSA runs an authorization model: your package is reviewed, an authorization decision is made, and the system then stays under continuous monitoring and periodic re-evaluation. The evidence discipline is similar, but the lifecycle and the decision-maker differ.
Can our existing 800-171 program be reused for GSA?
Mostly, yes, if it was built at the assessment-objective level. The usual deltas are the revision and parameter values GSA specifies, the showstopper requirements that must be closed before authorization, and the packaging GSA's process expects. Closing them is mapping and remediation work on the program you already have.
Get authorization-ready before the review clock starts.
Tell us where your GSA work stands (order language, current posture, timeline), and a practitioner will map the package and the showstoppers. Or email rj@indirectit.com directly.