In April 2023, GAO found that none of seven DHS programs with decision events after July 2020 completed the required cybersecurity risk memo. GAO told DHS to say which programs need one and when exemptions apply, and the recommendation was open as of GAO's last update.
In April 2023, GAO published DHS Annual Assessment: Major Acquisition Programs Are Generally Meeting Goals, but Cybersecurity Policy Needs Clarification (opens in a new tab) (GAO-23-106701). GAO reviewed 25 DHS major acquisition programs. Most of the report covers cost and schedule baselines, and one section covers cybersecurity.
DHS Instruction 102-01-012, Cybersecurity through the Acquisition Lifecycle Framework, issued in July 2020, requires major programs to present a cybersecurity risk recommendation memorandum (CRRM) at acquisition decision events (ADEs). A CRRM states the program's cybersecurity status and a high, medium, or low risk recommendation, and the DHS Chief Information Security Officer signs it out.
None of the seven programs that held ADEs after the instruction completed one. One showed GAO a DHS waiver. The other six said they used other documentation, that a CRRM did not apply, or that they did not develop one.
GAO recommended that DHS, as it updates the instruction, clarify "(1) which major acquisition programs are required to have completed cybersecurity risk recommendation memorandums prior to acquisition decision events, and (2) when exemptions apply." DHS concurred. GAO also made one nonpublic recommendation in a sensitive version of the report.
The instruction left three questions open, according to GAO: when the CRRM requirement can be waived, when it does not apply, and what other documentation can stand in for it. Programs answered those questions one at a time. GAO warned that without clear exemption rules, "programs may not prepare the memorandums when they are needed," and that DHS may then lack the information to assess cybersecurity risk and confirm that mitigations are adequate.
The fix has moved slowly. DHS told GAO in 2023 that it planned to implement the recommendation by March 30, 2024. GAO's status notes say DHS added CRRM completion as a required document for all major programs in its primary acquisition instruction, 102-01-001, in January 2023. In April 2025, DHS's Office of Program Accountability and Risk Management said the revision would specify which programs need the memos and when exemptions apply, with completion planned for December 2025.
Evaluators on DHS major-program cyber and authorization requirements can read GAO-23-106701. They know that a CRRM is a risk call with a status line behind it, and that both rest on records a contractor keeps.
A technical volume that treats the memo as a document to be typed before a milestone reads thin. A stronger volume shows how the offeror keeps the underlying record ready on the date a decision event is called. It also says what the offeror does when a program office believes an exemption applies, because that was where all seven programs ended up.
Timing matters too. If DHS finalizes its revision, exemptions will be written down. A bid that ties its method to the instruction as published on the solicitation date, and shows how it adapts when the instruction changes, answers the risk an evaluator is most likely to probe.
The method comes from Avalon's NIST RMF Implementation service. It describes how the work is done, at the methodology level, for one program at a time in unclassified environments. The CISO signs the CRRM and the Authorizing Official makes the authorization decision. Avalon does neither.
All five steps work inside NIST SP 800-37 Rev. 2 (opens in a new tab), which supports authorization decisions based on continuous monitoring.
GAO closes the recommendation on DHS action, not contractor action. The evidence is an updated DHS instruction that says which major programs must complete a CRRM before ADEs and when exemptions apply. GAO's own notes show the department was working toward that revision.
At the program level, these are targets, not GAO criteria:
Open as of GAO's last update, April 2025. GAO lists the recommendation as open and partially addressed, and its product page shows no last-updated date. DHS planned to complete the instruction revision in December 2025, and the page did not show that revision as complete when Avalon read it in October 2026. The sensitive recommendation is not public and is not covered here.
| Field | Detail |
|---|---|
| NAICS | 541512; 541519 |
| Avalon's sub role | Decision-event posture calendar, FIPS 199 and SP 800-53B baseline validation, inherited-control matrix, ISCM status metrics, and a substitute-document gap map under the prime's A&A or program-office cyber support task order, in unclassified environments |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | GSA MAS (SIN 54151HACS Highly Adaptive Cybersecurity Services); GSA MAS (SIN 54151S IT Professional Services); GSA Alliant 3 |
If DHS major-program cyber or authorization support is in your capture plan, Avalon teams as the sub that keeps each program's categorization, inheritance, and monitoring records dated and ready, so the prime can put evidence in front of the CISO at every decision event.
