GSA Looking for Identity Protection Service Providers

The GSA's call for more contractors to provide identity protection services, particularly data breach response and identity protection, reflects the increasing demand for these services across federal agencies. As Blackfyre, a GSA Federal Schedule Consulting firm, we understand the significance of this development and are poised to guide companies through the complex process of offering these services under the GSA Schedule. Here's a comprehensive look at the situation and how companies can navigate these changes.

The Growing Need for Identity Protection Services

Identity Protection Services (IPS) Multiple Award Blanket Purchase Agreement (BPA) has been utilized since its establishment in 2015, to give federal agencies streamlined access to identity monitoring and data breach response services. However, with the BPA set to expire, GSA is transitioning these services to be offered under SIN 520-20.

The Office of Management and Budget's designation of the GSA IPS BPA as a preferred source promotes the critical importance of these services. Post its expiration, SIN 520-20 on the GSA Professional Services Schedule (PSS) will become the primary source for these services.

Understanding SIN 520-20

GSA is transitioning from the IPS BPA to SIN 520-20 under the Financial and Business Solutions (FABS) category of the GSA PSS. This shift is intended to provide greater flexibility and address pricing difficulties encountered under the BPA.

The redefined SIN 520-20 now focuses on a comprehensive suite of services including identity monitoring, identity theft insurance, identity restoration services, and the protection of Personally Identifiable Information (PII) and Protected Health Information (PHI).

Challenges for Companies

Offering services under SIN 520-20 brings with it distinct technical, pricing, and reporting challenges. A few companies currently offering these services due to the stringent security requirements, which many potential providers find challenging.

• The necessity of a moderate impact level System Security Plan (SSP) that conforms to NIST Special Publication (SP) 800-53, among other standards. This requirement is recognized as rigorous but crucial.
• Companies must offer total solution pricing, either per year per impacted individual or per year per enrollee, depending on the agency's needs. This pricing model, along with optional individual component pricing, demands careful navigation and strategic planning.

Navigating the Process with Blackfyre

As a company interested in offering data breach and identity protection services under the GSA Schedule, partnering with an experienced GSA schedule consulting firm like Blackfyre is crucial.

1. Eligibility Assessment: Our team will help you understand the requirements of SIN 520-20 and assess your company's eligibility, including the capability of creating a compliant SSP.

2. Proposal Preparation: Our experts will guide you through the proposal process, ensuring your offer aligns with all the technical, pricing, and security requirements.

3. Ongoing Compliance and Management: Post award, we'll assist in managing your GSA Schedule Contract, ensuring ongoing compliance and helping you navigate any modifications or updates needed.

Blackfyre, led by a former GSA Schedule Reviewer, is committed to guiding companies through the complexities of acquiring and managing GSA Schedule Contracts, with a special focus on high-demand, specialized areas like data breach response and identity protection services.

With the growing need for these services in the federal marketplace, now is the time for your company to expand its offerings and meet critical government needs. Contact us to discuss how we can support your journey towards providing these essential services to federal agencies.