The General Services Administration (GSA) rolled out a sweeping new set of cybersecurity requirements that will affect civilian federal contracts worth billions of dollars each year. The policy, which applies immediately to new solicitations, represents one of the most consequential changes to federal acquisition security in recent memory—yet it arrived without the prolonged public debate that defined similar efforts at the Pentagon. The new framework closely resembles the De