MAS - Intelligent Network Security LLC - 47QTCA18D00CT

Intell

Table of Contents:

Contents

I. About Intelligent Network Security Intelligent Network Security

Intelligent Network Security, LLC ("INS") is a Center for Veterans Enterprise (CVE) certified Service-Disabled Veteran-owned Small Business (SDVOSB) and Small Business Administration (SBA) Certified HUBZone specializing in providing information technology professional and cybersecurity services. Established in 2005, INS has many years of professional and cybersecurity experience in government network security operations and in building, deploying, and monitoring network firewalls; monitoring Intrusion Detection Systems (IDS); building, deploying, and monitoring host and network based IDS; network support and IT outsourcing; network security engineering and implementation; digital forensics; threat analysis; forensic analysis; flow analysis; large dataset analysis; forensic log analysis; malicious code analysis; malware reverse engineering; and cyber hunt by utilizing Advanced Persistent Threat Detection technologies to combat computer adversaries from extracting knowledge or data from network systems.

Certifications

INS’ certifications include: CVE SDVOSB; SBA Certified HUBZone; Certified Ethical Hacker; Certified Network Penetration Tester; ENCASE Certified Examiner; CIAC Certified Examiner (ENCE); GIAC Certified Incident Handler (GCIH); GIAC Certified Intrusion Analyst (GCIA); GIAC Certified Project Manager; Microsoft Certified Professional; CISCO Certified Network Associate (CCNA); CISCO Certified Network Professional – Security (CCNP); Certified Information Systems Security Professional (CISSP); SOURCEFIRE SNORT Certified Professional (SFCP); Open Source Security Testing Methodology Manual (OSSTMM) Professional Security Tester (OPST); SPLUNK Ver 6 Certified Knowledge Manager; Global Industrial Cyber4 Security Professional (GICSP).

Commitment to Quality Control

INS is committed to providing high quality products and services to our customers. This is accomplished through training, planning, collaboration, monitoring, risk identification and corrective action. We believe that quality control is the responsibility of every member of the INS team. Therefore, the processes contained in our quality control plan are incorporated into all aspects of our efforts. Achievement of quality product/service support is contingent on skilled, knowledgeable, and experienced personnel, who comprise the INS team.

II. Contract Information

1. TABLE OF AWARDED SPECIAL ITEM NUMBERS (SINs)

· Cyber Hunt

· Incident Response

· Penetration Testing

· High Value Asset (HVA)

· Risk and Vulnerability Assessment (RVA) 54151S Information Technology Professional Services

2. MAXIMUM ORDER*: The maximum order is $500,000 for SINs 54151HACS and 54151S

*If the best value selection places your order over the Maximum Order identified in this catalog/price list, you have an opportunity to obtain a better schedule contract price. Before placing your order, contact the aforementioned contactor for a better price. The contractor may (1) offer a new price for this requirement (2) offer the lowest price available under this contract or (3) decline the order. A delivery order that exceeds the maximum order may be placed under the schedule contract in accordance with FAR 8.404.

3. MINIMUM ORDER: $100

4. GEOGRAPHIC COVERAGE: Domestic delivery within the 48 contiguous states, Alaska, Hawaii, Puerto Rico, Washington, DC, and U.S. Territories. Note that for products, domestic delivery also includes a port or consolidation point, within the aforementioned areas, for orders received from overseas activities.

5. POINT(S) OF PRODUCTION: N/A

6. DISCOUNT FROM LIST PRICES: Prices shown are GSA net prices

7. QUANTITY/VOLUME DISCOUNT: None

8. PROMPT PAYMENT TERMS: None

9. Government Purchase Cards are accepted below or above the micro purchase threshold.

10. FOREIGN ITEMS: N/A

11d. URGENT REQUIRMENTS: Agencies can contact the Contractor’s representative to affect a faster delivery. Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

12. FOB POINT: Destination Note: All travel required in the performance of this contract and orders placed hereunder must comply with the Federal Travel Regulations (FTR) or Joint Travel Regulation (JTR), as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all contractor travel. Contractors cannot use GSA city pair contracts. The contractor shall not add the Industrial Funding Fee onto travel costs.

13a. ORDERING ADDRESS: Same as Contractor’s address.

13b. ORDERING PROCEDURES: For supplies and services, the ordering procedures, information on Blanket Purchase Agreements (BPA’s) are found in Federal Acquisition Regulation (FAR) 8.405-3.

14. PAYMENT ADDRESS: PO Box 12, Spencer, WV 25276.

15. WARRANTY PROVISION: Standard Commercial Warranty. Customers should contact the contractor for a copy of the warranty.

16. EXPORT PACKING CHARGES: N/A

17. TERMS AND CONDITIONS OF GOVERNMENT PURCHASE CARD ACCEPTANCE: Accepted below or above the micro-purchase level.

18. TERMS AND CONDITIONS OF RENTAL, MAINTENANCE, AND REPAIR (IF APPLICABLE): N/A

19. TERMS AND CONDITIONS OF INSTALLATION (IF APPLICABLE): N/A

20a. TERMS AND CONDITIONS OF REPAIR PARTS INDICATING DATE OF PARTS PRICE LISTS AND ANY DISCOUNTS FROM LIST PRICES (IF AVAILABLE): N/A

20b. TERMS AND CONDITIONS FOR ANY OTHER SERVICES (IF APPLICABLE): N/A

21. LIST OF SERVICE AND DISTRIBUTION POINTS (IF APPLICABLE): N/A

22. LIST OF PARTICIPATING DEALERS (IF APPLICABLE): N/A

23. PREVENTIVE MAINTENANCE (IF APPLICABLE): N/A

24a. SPECIAL ATTRIBUTES SUCH AS ENVIRONMENTAL ATTRIBUTES (e.g. recycled content, energy efficiency, and/or reduced pollutants): N/A 24b. Section 508 Compliance for EIT: N/A

25. Unique Entity ID: LE2SN3C9HLH8

26. NOTIFICATION REGARDING REGISTRATION IN CENTRAL CONTRACTOR REGISTRATION (CCR) DATABASE: Contractor is registered and valid in SAM, cage code 69G24.

III. Terms and Conditions for all IT Contractors

Information Technology Category Instructions and Regulations

1) Organizational Conflicts Of Interest

a) Definitions.

"Contractor" means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

"Contractor and its affiliates" and "Contractor or its affiliates" refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An "Organizational conflict of interest" exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or (ii) impair the Contractor's or its affiliates' objectivity in performing contract work.

b) To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508

2) Services Performed

a) All services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

b) The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity.

c) The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

3) Travel. Any Contractor travel required in the performance of services must comply with the Pub. L. 99-234 and FAR Part 31.205-46, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel.

4) Warranty

a) Unless otherwise specified in the contract, the Contractor's standard commercial warranty applies.

b) The Contractor's commercial guarantee/warranty shall be included in the Commercial Supplier Agreement to include Enterprise User License Agreements or Terms of Service (TOS) agreements, if applicable.

c) Except as otherwise provided by an express or implied warranty, the Contractor will not be liable to the ordering activity for consequential damages resulting from any defect or deficiencies in accepted items.

Note: GSA will not award any Drones/Unmanned Aircraft Systems (UAS), as defined in 49 USC Ch. 448, in response to this Large Category except those drones approved by the Department of Defense (DoD) Defense Innovation Unit (DIU) through its Blue sUAS Program.

CONTRACTS FOR MAINTENANCE, CALIBRATION, OR REPAIR OF CERTAIN EQUIPMENT CERTIFICATION (MAY 2014)

CONSTRUCTION CONTRACTS (SEP 2013)

(APR 2022)

INDIVIDUALS WITH DISABILITIES (MAR 2022)

Subcategory Instructions and Regulations

F03. IT Services Subcategory Instructions:

Offerors submitting an offer for a SIN(s) under the "IT Services Sub-category" must also comply with the following:

a. Only IT Professional Services or Labor Categories shall be offered.

b. Resumes shall be provided to the GSA contracting officer or the ordering activity upon request.

c. Offerors shall provide a description of each type of IT Professional Service or Labor Category offered, and it should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

The following is an example of the manner in which the description of a commercial job title should be presented:

EXAMPLE: Commercial Job Title: System Engineer

Minimum/General Experience: Three (3) years of technical experience which applies to systems analysis and design techniques for complex computer systems. Requires competence in all phases of systems analysis techniques, concepts and methods; also requires knowledge of available hardware, system software, input/output devices, structure and management practices.

Functional Responsibility: Guides users in formulating requirements, advises alternative approaches, conducts feasibility studies.

Minimum Education: Bachelor's Degree in Computer Science

d. Pricing for each type of IT Professional Service or Labor Category shall be in accordance with customary commercial practices; e.g., hourly rates, monthly rates, term rates, and/or fixed prices, minimum general experience and minimum education.

e. Pricing of services shall be offered at the Contractor's facility and/or at the ordering activity location in accordance with customary commercial practices.

f. All awarded professional services/labor categories shall be included as an attachment to the GSA Price List (I-FSS-600 CONTRACT PRICE LISTS (OCT 2016)) in the format provided above.

SIN 54151HACS Highly Adaptive Cybersecurity Services (HACS)

54151HACS Includes a wide range of fields such as, the seven-step Risk Management Framework services, information assurance, virus detection, zero trust architecture, network management, situational awareness and incident response, secure web hosting, backups, security services and Security Operations Center (SOC) services. HACS vendors are cataloged under the 5 subcategories of High Value Asset Assessments; Risk and Vulnerability Assessments, Cyber Hunt, Incident Response, and Penetration Testing.

Cooperative Purchasing: Yes

NAICS

Instructions:

Additional SIN Description: Includes proactive and reactive cybersecurity services that improve customer enterprise-level security posture. Services to identify and protect a customer's information resources, detect and respond to cybersecurity events or incidents, and recover capabilities or services impaired by any incidents that emerge.

It encompasses a wide range of fields that include, but are not limited to, Risk Management Framework (RMF) services, information assurance (IA), virus detection, network management, situational awareness and incident response, secure web hosting, and backup and security services.

The seven-step RMF includes preparation, information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. RMF activities may also include Information Security Continuous Monitoring Assessment (ISCMA), which evaluate organization-wide ISCM implementations, and also Federal Incident Response Evaluations (FIREs), which assess an organization's incident management functions.

It also includes Security Operations Center (SOC) services. The SOC scope includes services such as: 24x7x365 monitoring and analysis, traffic analysis, incident response and coordination, penetration testing, anti-virus management, intrusion detection and prevention, and information sharing.

1. Specific Instructions for SIN 54151HACS - Highly Adaptive Cybersecurity Services (HACS)

a. Offerors may request to be placed in the following subcategories.

i. High Value Asset (HVA) Assessments include Risk and Vulnerability Assessment (RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing. Security Architecture Review (SAR) evaluates a subset of the agency s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems. SAR provides a holistic analysis of how an HVA’s individual security components integrate and operate, including how data is protected during operations. The SAR uses the RMF when designing and implementing the seven tenets of zero trust architecture by describing how the steps in the RMF map to similar steps described in NIST Special Publication (SP) 800-207, Zero Trust Architecture. Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on, but is not limited to the following security areas: perimeter security, network security, endpoint security, application security, physical security, and data security.

ii. Risk and Vulnerability Assessment (RVA) assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing.

iii. Penetration Testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

iv. Incident Response services help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.

v. Cyber Hunt activities respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunts start with the premise that threat actors known to target some organizations in a specific industry or with specific systems are likely to also target other organizations in the same industry or with the same systems.

b. Services offered SIN 54151HACS shall be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

i. Federal Acquisition Regulation (FAR) Part 52.204-21

ii. OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of Personally Identifiable Information (PII)

iii. OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program

iv. 2017 Report to the President on Federal IT Modernization

v. The Cybersecurity National Action Plan (CNAP)

vi. NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology Systems

vii. NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security)

viii. NIST SP 800-30 - Guide for Conducting Risk Assessments

ix. NIST SP 800-35 - Guide to Information Technology Security Services

x. NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations: A Systems Life Cycle Approach for Security and Privacy

xi. NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View

xii. NIST SP 800-44 - Guidelines on Securing Public Web Servers

xiii. NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

xiv. NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

xv. NIST SP 800-61 - Computer Security Incident Handling Guide

xvi. NIST SP 800-64 - Security Considerations in the System Development Life Cycle

xvii. NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

xviii. NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

xix. NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment

xx. NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information Systems

xxi. NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

xxii. NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

xxiii. NIST SP 800-160 - Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

xxiv. NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and Organizations

xxv. NIST SP 800-207 - Zero Trust Architecture

c. All professional labor categories under SIN 54151S Information Technology Professional Services may remain there, unless the labor categories are specific to SIN 54151HACS.

2. Oral Technical Evaluation for SIN 54151HACS - Highly Adaptive Cybersecurity Services (HACS)

a. Unless otherwise specified, the offeror shall participate in an oral technical evaluation that will be conducted by a Technical Evaluation Board (TEB). The oral technical evaluation will be held at the unclassified level and will be scheduled by the TEB. The oral technical evaluation will be used to assess the offeror's capability to successfully perform the services within the scope of each subcategory as set forth in this solicitation, excepting those service components awarded through the submission of the Service Self-Attestation. The Self-Attestation form is available at gsa.gov/hacs.

An offeror may only be awarded SIN 54151HACS upon successful completion of the Highly Adaptive Cybersecurity Services oral technical evaluation. If the offeror elects to be cataloged under the "Cyber Hunt" and/or "Incident Response" subcategories, additional questions related to those areas will be asked during the HACS Oral Technical Evaluation.

i. ORAL TECHNICAL EVALUATION CONSTRAINTS: The offeror shall identify up to five key personnel, by name and association with the offeror, who will field questions during the oral technical evaluation. The HACS SIN consists of 5 subcategories. The base HACS Oral Technical Evaluation consists of questions related to the 3 subcategories of, High Value Asset Assessments, Risk and Vulnerability Assessments and Penetration Testing. One (1) hour and 40 minutes is allotted for the base HACS Oral Technical Evaluation. The evaluation will be stopped precisely after 1 hour and 40 minutes. Should the offeror elect to be considered for the additional subcategories of Incident Response and Cyber Hunt, an additional 10 minutes will be allotted for each of those subcategories. The total base evaluation session is expected to last up to 1 hour and 40 minutes, depending on the number of subcategories the offeror is proposing. The TEB Chairperson will be responsible for ensuring the schedule is met and that all offerors are given the same opportunity to present and answer questions.

ii. ORAL TECHNICAL EVALUATION SCHEDULING: The TEB will contact the offeror's authorized negotiator or the signatory of the SF 1449 via email to schedule the oral technical evaluation. Evaluation time slots will be assigned on a first-come-first-served basis. The Government reserves the right to reschedule any offeror's oral technical evaluation at its sole discretion. The oral technical evaluation will be held at facilities designated by the TEB. The exact location, seating capacity, and any other relevant information will be provided when the evaluations are scheduled. The Government may also make accommodations for vendors to participate in the oral evaluations virtually.

iii. PROHIBITION OF ELECTRONIC RECORDING OF THE ORAL TECHNICAL EVALUATION: The offeror may not record or transmit any of the oral evaluation process. All offeror's electronic devices shall be removed from the room during the evaluation. The offeror is permitted to have a timer in the room during the evaluation, provided by the TEB.

iv. RESUBMISSION RESTRICTIONS FOR UNSUCCESSFUL VENDORS UNDER THIS EVALUATION FACTOR: The TEB will afford the offeror multiple opportunities to achieve the "pass" criteria under this evaluation factor through "clarification" questioning, during the Oral Technical Evaluation. Any offeror whom the TEB has found to have not passed under this evaluation factor shall be failed and shall be ineligible to re-submit under the SIN to participate in this evaluation factor for a period of six (6) months following the date of failure.

v. FOR REJECT AND WITHDRAWN OFFERS OR MODIFICATIONS: An offeror or contractor can re-apply for SIN 54151HACS if they are rejected or withdrawn.

1. If an offeror or contractor passes the oral technical evaluation but their offer or modification is rejected or withdrawn, they can re-apply within six (6) months after the oral technical evaluation completion date without having to participate in the oral technical evaluation again. When documentation is resubmitted for review for a new offer/modification, include a statement in the cover letter that the capabilities remain current, accurate, and complete as stated during the oral technical evaluation.

2. If an offeror or contractor passes the oral technical evaluation but their offer or modification is rejected or withdrawn and they do not re-apply within six (6) months after the oral technical evaluation completion date, they must participate in a new oral technical evaluation in order to add SIN 54151HACS.

vi. HIGH VALUE ASSET (HVA) ASSESSMENTS SUBCATEGORY PLACEMENT: Any offeror previously awarded all of the following four SINs: 132-45A Penetration Testing, 132-45B Incident Response, 132-45C Cyber Hunt, and 132-45D Risk and Vulnerability Assessment, shall not be subject to a Highly Adaptive Cybersecurity Services oral technical evaluation, so long as they provide in the modification package to the GSA contracting officer a Service Self-Attestation acknowledging their ability to perform Security Architecture Review (SAR) and Systems Security Engineering (SSE) services in their entirety. The Self-Attestation form is available at gsa.gov/hacs.

a. Oral Technical Evaluation Procedures: The offeror will be evaluated on their knowledge of the proposed services. The oral technical evaluation will require the offeror to respond to a specific scenario and general questions to assess the offeror's expertise. The competencies, criteria and evaluation minimums for the questions are below: All new offerors and modifications must participate in and PASS the HACS Oral Technical Evaluation. The Oral Technical Evaluation will include, at a minimum, questions on Risk and Vulnerability Assessment (RVA), Security Architecture Review (SAR), Systems Security Engineering (SSE), and Penetration Testing. At the time of submission, all new offerors and modifications can also elect to be cataloged in one or both of the additional subcategories of Cyber Hunt or Incident Response (IR). Should this election be taken, additional questions related to these subcategories will be included in their HACS evaluation and these additional subcategory topics must be passed as well.

b. Oral Technical Evaluation Criteria: The offeror's responses to the government's questions during the oral technical evaluation session shall be used to determine whether the offeror has the requisite experience and expertise to perform tasks expected to be performed within the scope of the SIN. The oral technical proposal will be evaluated and rated on a pass/fail basis. The rating definitions provided below will be used for the evaluation of the offeror's responses to questions during the oral evaluation.

c. SIN Subgroups: Upon completion of the oral technical evaluation for both offers and modifications, the government will determine which of the following 5 SIN subgroups apply:

1. High value Asset (HVA) Assessments

2. Risk and Vulnerability Assessment (RVA)

3. Cyber Hunt

4. Incident Response

5. Penetration Testing

Following notification that they are eligible for one or more of the 5 SIN subgroups, awarded contractors may select the corresponding subgroups by following the instructions below:

1. Login to eBuy

2. From the top menu, select "Profile"

3. Click "Modify Subgroups"

4. Select the applicable subgroups according to the instructions

All contractor selections will be monitored by GSA for compliance and action will be taken against your contract if you select Subgroups that have not been awarded under your contract.

Note: All services shall be billed in arrears in accordance with 31 U.S.C. 3324.

TECHNICAL RATINGS

SIN 54151S Information Technology Professional Services

54151S IT Professional Services and/or labor categories for database planning and design; systems analysis, integration, and design; programming, conversion and implementation support; network services, data/records management, and testing.

NOTE: Subject to Cooperative Purchasing

Cooperative Purchasing: Yes

NAICS

Instructions:

1. Specific Instructions for SIN 54151S - Information Technology Professional Services:

* All services shall be billed in arrears in accordance with 31 U.S.C. 3324.

IV. Labor Category Descriptions

A. Labor Category Descriptions - SIN 54151HACS: Highly Adaptive Cybersecurity Services (HACS)

POSITION DESCRIPTIONS/QUALIFICATIONS SIN 54151HACS

Position Descriptions:

Cyber Principal Subject Matter Expert/Project Manager Minimum Experience: Minimum of twelve years of progressive experience supporting information technology projects with at least four years related to information and computer security.

Functional Responsibility: Assist CIOs, CISOs and Program Managers to assess, develop, implement and maintain enterprise information programs. Assist clients to interpret policies and standards related to network, information and cybersecurity. Develop strategies for implementing all aspects of Network/Information/Cybersecurity professional services and programs as well as Privacy. Devise solutions to speed adoption of standards, policy and procedures as well as measure performance and compliance. Develop policy, procedures, and best practices. Prepare presentations, papers and other materials to support the CIO, CISO and program managers to communicate policy, requirements, practices and solutions to business and system owners. Program security program office support ranging from analysis, planning, and budget. Manage project requirements, resources and deliverables. Prepare and provide management and project reports.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, and SFCP.

Recommended broad knowledge of all systems that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

Cyber Subject Matter Expert Experience: Minimum of ten years of progressive experience supporting information technology projects with at least four years related to information and computer security.

Functional Responsibility: Assist CIOs, CISOs and Program Managers to assess, develop, implement and maintain enterprise network/information/cybersecurity programs. Assist clients to interpret policies and standards related to network/information and cybersecurity. Develop strategies for implementing all aspects of Network/Information/Cybersecurity professional services and programs as well as Privacy. Devise solutions to speed adoption of standards, policy and procedures as well as measure performance and compliance. Develop policy, procedures, and best practices. Prepare presentations, papers and other materials to support the CIO, CISO and program managers to communicate policy, requirements, practices and solutions to business and system owners. Program security program office support ranging from analysis and planning. Manage project requirements, resources and deliverables. Prepare and provide management and project reports.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, SFCP.

Recommended broad knowledge of all systems that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

Cyber Administrative Program Manager/Facility Security Officer Experience: Minimum of eight years general administrative experience. Specialized experience includes: practical experience in managing projects, project development, management and control of project funds and resources, demonstrated capability in managing multi-task projects of various complexity.

Functional Responsibility: Serve as the authorized interface with the customer agency’s Contracting Officer’s Representative and technical representatives. Ensure work standards; assign contractor staff tasking; supervise assigned contractor personnel; prepare required reports; and communicate policies, purpose and goals of the organization to subordinates. Applies corporate and customer quality assurance standards. Accomplish human resource objectives by recruiting, selecting, orienting, training, assigning, scheduling, coaching, counseling, and disciplining employees; communicating job expectations; planning, monitoring, appraising, and reviewing job contributions; planning and reviewing compensation actions; enforcing policies and procedures; and resolving work discrepancies.

Additionally, manage or process personnel security clearance applications, as well as periodic reinvestigations in accordance with various government customer security requirements; ensure security indoctrinations, debriefings, pre/post travel briefings and annual refresher briefings; assist with development of security policies and procedures consistent with government’s Insider Threat Program; enforce standards for protection of company personnel, property, and information; investigate security violations and submit required reports to the government; document and maintain personnel security files and rosters; and establish and maintain successful working relationships with government and internal customer.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, and SFCP.

Recommended broad knowledge of all systems that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, Administration or other related discipline.

Cyber Analyst III Experience: Minimum of eight years of experience performing analysis or research related to network/IT security vulnerabilities.

Functional Responsibility: Review, isolate, analyze and reverse-engineer programs that are vulnerable or malicious code in order to determine and understand the specific nature of the threat. Provide professional network/information/cyber services. Document the specific capabilities of the malware and understand the concept of exploitation methodology. Create a detailed technical report of the threat. Provide defense counter measures via signatures and/or heuristics to customers or other team members. Stay apprised of current threat tactics, techniques, and methodologies in order to develop and prepare defensive counter- measures. Analyze current network protocols and applications in order to ascertain vulnerabilities.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, SFCP.

Recommended broad knowledge of all systems that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

Cyber Analyst II Experience: Minimum of six years of experience performing analysis or research related to network/IT security vulnerabilities.

Functional Responsibility: Provide professional network/information/cyber services. Review, isolate, analyze and then reverse-engineer programs that are vulnerable or malicious code in order to determine and understand the specific nature of the threat. Document the specific capabilities of the malware and understand the concept of exploitation methodology. Analyze common network protocols applications in order to ascertain vulnerabilities.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, and SFCP.

Recommended broad knowledge of all systems that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

Threat Analyst III Experience: Minimum of eight years of experience performing analysis or research related to IT security vulnerabilities.

Functional Responsibility: Provide professional network/information/cyber services. Review, isolate, analyze and reverse-engineer programs that are vulnerable or malicious code in order to determine and understand the specific nature of the threat. Document the specific capabilities of the malware and understand the concept of exploitation methodology. Create a detailed technical report of the threat. Provide defense counter measures via signatures and/or heuristics to customers or other team members. Stay apprised of current threat tactics, techniques, and methodologies in order to develop and prepare defensive counter measures. Analyze current network protocols and applications in order to ascertain vulnerabilities.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, and SFCP.

Recommended broad knowledge of all systems that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

ICS/SCADA Analyst III Experience: Minimum of eight years of experience in network/information/cyber security analysis; computer and network security; operational expertise in WAN and IP addressing, practical use of network/information/cyber forensics analysis tools, and multi-source intelligence analysis in U.S. intelligence community activities. Investigative experience in dealing with national security matters related to network/information/cyber based investigations and security.

Functional Responsibility: Provide professional network/information/cyber services. Monitor and perform analysis using various industry and government tools, techniques and technologies to ensure the health and security posture of the government’s network and associated systems are maintained. Monitor various resources and technologies such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), data feeds, alerts and logs from firewalls, routers, and other network devices to watch for security violations and determine vulnerabilities. Identify, investigate and analyze events of Industrial Control Systems (ICS) Supervisory Control and Data Acquisitions (SCADA) significance. Adapt and develop tools for applying standard information security and analysis practices to the ICS SCADA mission. Perform all source intelligence analysis to include technical, public source and classified information, to determine characteristics of various systems and/or issues. Report changes, trends and implications of evolving issues. Collect data, analyze results, and prepare reports relating to project/program objectives. Integrate results of research and analysis into operations. Analyze classified and unclassified networks to identify security vulnerabilities and intrusion detection parameters. Operate as an integral part of a team’s mission activities to detect, deter, and neutralize technological threats against the customer’s information systems.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, and SFCP.

Recommended broad knowledge of all systems that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

ICS/SCADA Analyst II Experience: Minimum of six years of experience in network/information/cyber security analysis; computer and network security; operational expertise in WAN and IP addressing, practical use of forensics analysis tools, multi-source intelligence analysis in U.S. intelligence community activities. Investigative experience in dealing with national security matters related to information-based investigations and security.

Functional Responsibility: Provide professional network/information/cyber services. Monitor and perform analysis using various industry and government tools, techniques and technologies to ensure the health and security posture of the government’s network and associated systems are maintained. Monitor various resources and technologies such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), data feeds, alerts and logs from firewalls, routers, and other network devices to watch for security violations and determine vulnerabilities. Identify, investigate and analyze events of Industrial Control Systems (ICS) Supervisory Control and Data Acquisitions (SCADA) significance. Perform all source intelligence analysis to include technical, public source and classified information to determine characteristics of various systems and/or issues. Report changes, trends and implications of evolving issues. Collect data and analyze results relating to project/program objectives. Integrate results of research and analysis into operations. Analyze classified and unclassified networks to identify security vulnerabilities and intrusion detection parameters. Operate as an integral part of a team’s mission activities to detect, deter, and neutralize technological threats against the customer’s information systems.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, and SFCP.

Recommended broad knowledge of all systems that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

Cyber Engineer II Experience: Minimum of six years of experience supporting information technology projects in system design, engineering or operations with at least two years of experience related to information or computer security.

Functional Responsibility: Provide professional network/information/cyber services and direct support for engineering, implementing, integrating and operating network/information/cyber security. Responsibility may span to design of technical solutions for network boundary protection, endpoint security, access control, auditing, log management, event management and correlation, and network monitoring; network and system vulnerability assessment; application and software security assessment; database security assessment and monitoring; software security assurance; security configuration assessment, and compliance management; incident handling, response and reporting; technical security support to Certification and Accreditation (C&A) processes and testing and security impact assessments as part of change management. Conduct network security monitoring and media imaging for forensic analysis.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, and SFCP.

Recommended broad knowledge of all systems that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

Intelligence Analyst III Experience: Minimum of eight years of experience in network/information/cyber investigations; computer and network security; operational expertise in WAN and IP addressing, practical use of network/information/cyber forensics analysis tools, multi-source intelligence analysis in U.S. intelligence community activities. Investigative experience in dealing with national security matters related to network/information/cyber based investigations and security.

Functional Responsibility: Provide professional network/information/cyber services. Monitor and perform analysis using various industry and government tools, techniques and technologies to ensure the health and security posture of customer’s network and associated systems are maintained. Monitor various resources and technologies such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), data feeds, alerts and logs from firewalls, routers, and other network devices to watch for security violations and determine vulnerabilities. Identify, investigate and analyze events of intelligence significance. Adapt and develop tools for applying standard network/information/cyber security and analysis practices to the intelligence mission. Perform all source intelligence analysis to include technical, public source and classified information, to determine characteristics of various systems and/or issues. Report changes, trends and implications of evolving issues. Collect data, analyze results, and prepare reports relating to project/program objectives. Integrate results of research and analysis into operations. Analyze classified and unclassified networks to identify security vulnerabilities and intrusion detection parameters. Operate as an integral part of a team’s mission activities to detect, deter, and neutralize technological threats against customer information systems.

Recommended Certifications/Training includes but is not limited to: CISSP, ICS/SCADA Training, GICSP, GCIH, and SFCP.

Recommended broad knowledge of all system that are housed in a Network Security Operations Center including: Windows operating systems, Cisco operating systems, Unix operating systems, and SCADA operating systems.

Minimum Education: Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

Intelligence Analyst II Experience: Minimum of six years of experience in network/information/cyber investigations; computer and network security; operational expertise in WAN and IP addressing, practical use of network/information/cyber forensics analysis tools, multi-source intelligence analysis in U.S. intelligence community activities. Investigative experience in dealing with national security matters related to network/information/cyber based investigations and security.

Functional Responsibility: Provide professional network/information/cyber services. Monitor and perform analysis using various industry and government tools, techniques and technologies to ensure the health and security posture of customer’s network and associated systems are maintained. Monitor various resources and technologies such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), data feeds, alerts and logs from firewalls, routers, and other network devices to watch for security violations and determine vulnerabilities. Identify, investigate and analyze events of intelligence significance.