Security Ratings of U.S. Federal Agencies & Government Contractors

The federal government relies on tens of thousands of contractors and subcontractors — often referred to as the federal “supply chain” — to provide critical services, hold or maintain sensitive data, deliver technology, and perform key functions. Along with the Federal Government itself, these contractors and subcontractors face a multitude of cyber threats.

In response, U.S. federal agencies have or are considering expanding cybersecurity requirements for their contractor base and adopting best practices for evaluating and monitoring those entities. While the Department of Defense (DOD) has recently tightened requirements, the General Services Administration (GSA) is planning to follow suit and demand that contractors meet guidelines set by the National Institutes of Standards and Technology.

In our recently published Bitsight Insights, Bitsight researchers set out to understand the security performance of government contractors. What is the cybersecurity performance of U.S. federal contractors, and how does that compare to the performance of U.S. federal agencies?

To perform this assessment, Bitsight researchers took a random sample of over 1,200 U.S. federal government contractors across the following industries: Aerospace/Defense, Business Services, Healthcare/Wellness, Engineering, Technology, and Manufacturing. The cybersecurity performance of these contractors was compared with the performance of over 120 U.S. federal agencies.

Comparison of Security Posture

There is a significant gap between the security performance of U.S. federal agencies and their contractors. To some this may be surprising, given large high-profile breaches of U.S. federal agencies in recent years. Many agencies maintain a strong security posture overall and the aggregate performance of agencies has increased steadily. The mean rating for agencies as of January 2018 was 725. This is markedly higher than any of the other sector of contractors for the U.S. federal government observed in this study.

The spread of Bitsight Security Ratings amongst federal agencies and contractors as of February 1, 2018.

Within the federal contractor base, Healthcare/Wellness, Business Services, and Aerospace/Defense were the strongest security performers last year relative to other industries, performing between a 700–710 throughout the year, while Engineering, Technology, and Manufacturing were the weakest performers.

Prevalence of Botnet Infections

In May 2017, President Trump released an Executive Order on Cybersecurity that called upon the Secretaries of Commerce and Homeland Security to dramatically reduce botnets across the internet. Previous Bitsight research has consistently shown that botnets (and other forms compromised systems) increase the likelihood of a publicly disclosed breach: organizations with a Bitsight botnet grade of B or lower are more than twice as likely to experience a data breach. Botnets can deliver high-volume network attacks and distribute spam and malware to organizations.

Bitsight data shows that the U.S. federal government and its contractor base have pervasive botnet infections on their networks. A large number of contracting sectors — such as Healthcare/Wellness, Manufacturing, and Engineering — performed at a significantly lower rate than government agencies: 24% of Healthcare/Wellness and Manufacturing contractors have a Bitsight botnet grade below B, while 15% of U.S. government agencies perform below a B. This data suggests that these organizations have ineffective security programs in place and may be experiencing ongoing data breaches.