By: Darren Guccione, CEO and co-founder, Keeper Security

The United States is at a pivotal moment in its efforts to defend against modern cyber threats. Advanced Persistent Threats (APTs) from nation-states and organized cybercriminals continue to grow in both sophistication and scale, while many federal agencies operate with legacy acquisition models that struggle to keep pace with today’s threat environment.

Closing this gap is a national security imperative. A unified approach – where federal agencies and the private sector work side by side – is essential to staying ahead of adversaries that innovate relentlessly. Recent updates to the Federal Acquisition Regulation (FAR) represent a meaningful step forward, modernizing how agencies procure and deploy commercial cybersecurity solutions built to defend against contemporary threats. Reforms to the FAR  are streamlining how technology providers deliver solutions to the federal government. By prioritizing true Commercial Off-the-Shelf (COTS) offerings, these changes reduce friction for agencies seeking proven, enterprise-grade capabilities already in use across the private sector. 

Notably, the updated framework enables vendors to offer standardized, pre-vetted FedRAMP Software-as-a-Service (SaaS) solutions as recognized COTS products. This eliminates the need to engineer and maintain separate, dedicated government infrastructure, allowing agencies to benefit from the pace of commercial innovation rather than remaining tethered to static, isolated environments.The General Services Administration’s OneGov acquisition strategy reinforces this shift by consolidating procurement pathways for FedRAMP-authorized SaaS offerings. Through a unified, pre-vetted marketplace, agencies can move away from fragmented, agency-specific contracts and adopt modern security tools with greater speed and consistency.

These reforms also enable agencies to move beyond lengthy, prescriptive Requests for Proposals and toward outcome-based procurement. Instead of specifying how a solution must be built, agencies can focus on the results it must deliver, such as reducing credential compromise, improving access visibility or enforcing least-privilege controls across complex environments. Recent updates to simplified acquisition procedures further support this agility, increasing the Simplified Acquisition Threshold to $350,000 and the Commercial Simplified Threshold from $7.5 million to $9 million. Together, these changes empower agencies to adopt modern cybersecurity capabilities at the speed required to defend critical systems.

A core component of OneGov is the ability for agencies to engage in low-risk pilot and proof-of-concept programs through a centralized marketplace. These initiatives allow agencies to evaluate pre-vetted solutions in real-world environments before committing to full-scale deployment. For federal teams, this approach reduces risk, accelerates stakeholder buy-in and uncovers integration considerations early. For industry partners, it creates a clearer, more collaborative path to delivering measurable value in support of agency missions.

As agencies gain greater flexibility in choosing solutions that best support their workforces, it is critical that vendors meet the highest standards of security and compliance.  FedRAMP and GovRAMP authorization, along with alignment to frameworks such as NIST, SOC 2 and ISO 27001, signals a vendor’s long-term commitment to protecting sensitive government data. Achieving these benchmarks requires integrating security controls directly into the product development lifecycle – not bolting them on later. High-assurance, zero-trust solutions that deliver visibility, scalability and continuous monitoring are foundational to protecting federal systems and critical infrastructure.

Cybersecurity is national security. Sustained collaboration between government and the private sector is essential to anticipating emerging threats and countering increasingly capable adversaries. The latest procurement reforms create a clearer path for commercial innovation to strengthen federal defenses, provided agencies and industry act decisively and with shared purpose. By modernizing acquisition models and embracing proven, secure commercial technologies, the federal government can build a more resilient digital foundation – one that protects critical missions today while adapting to the threats of tomorrow.