Public procurement laws or regulations similar to HIPAA or PCI?

Question

United States here, and potentially also involving two states, New York and Vermont.

If a business is a vendor that sells goods to the federal government (as a GSA awarded contractor) and also sells goods to state procurement agencies (New York - Office of General Services, or OGS; and in Vermont its the Office of Purchasing & Contracting), they have to maintain inventory data and regularly submit updates to the agency they have an award with.

In a similar vein to how HIPAA regulates businesses who maintain health data, and PCI regulates businesses that collect payment information from consumers, are there any similar regulations that govern what such GSA/OGS/OPC vendors can do with their inventory data?

Answer 1

I've done quite a bit of digging through GSA regs and don't see anything indicating that such rules exist. The various portals for relaying such information to GSA don't indicate that there's any kind of meaningful restrictions on how vendors handle the data they submit.

I suspect this is a reflection of the idea that there's no real point forcing businesses to spend more money protecting their own information than they think is cost-efficient. A hospital or credit-card company with lax security endangers the private information of thousands or millions of customers who expect privacy, but a vendor who fails to secure his inventory data generally risks exposing only his own information, which may not even be secret in the first place. After all, GSA is but one customer for most vendors, who can't sell their products if they can't disclose their inventory and prices.