"Industry Groups Push Back Against New Cyber Reporting Rule for IT Suppliers"

IT suppliers selling services to the US government are unhappy with proposed changes to procurement rules that would require them to grant full access to their systems in the event of a security incident, as part of an update to the Federal Acquisition Regulation (FAR). The proposed changes, including a short reporting window and the maintenance of a software bill of materials, have been met with criticism from industry stakeholders who find them burdensome and inconsistent with other reporting rules. The growing number of disparate incident reporting requirements from various government agencies has led to calls for a single authoritative incident reporting process across the federal government and regulated sectors.