MAS - American Communications Solutions, LLC - 47QTCA18D00GK

GSA MAS SCHEDULE

FEDERAL ACQUISITION SERVICES PRICE LIST

SCHEDULE #: 47QTCA18D00GK

Special Item Numbers (SINs):

54151HACS – Highly Adaptive Cyber Security Services

54151S – Information Technology Professional Services OLM – Order-Level Materials Supplies and/or Services

UEI: VE4NKB8SJSH8

CAGE: 7WTB5

Submitted By:

American Communications Solutions, LLC

6320 Karmich St Fairfax Station, VA 22039 www.acommsolutions.com

Phone: 703-789-4481 http://www.acommsolutions.com/

AMERICAN COMMUNICATIONS SOLUTIONS

47QTCA18D00GK

May 5, 2023 i

GENERAL SERVICES

ADMINISTRATION FEDERAL

SUPPLY SERVICE

AUTHORIZED FEDERAL SUPPLY SCHEDULE CATALOG/PRICE LIST

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order is available through GSA Advantage! a menu-driven database system. The internet address for GSA Advantage! is http://www.gsaadvantage.gov

Multiple Award Schedule (MAS)

FSC GROUP: 70 Class D399 IT AND TELECOM- OTHER IT AND TELECOMMUNICATIONS

CONTRACT NUMBER:

CONTRACT PERIOD:

July 16, 2023 – July 15, 2028

Modification Number: 0006

Dated: 07/16/2023

American Communications Solutions, LLC 6320

Karmich St Fairfax Station, VA 22039

703-789-4481 703-543-2319 (fax) www.acommsolutions.com

Contract Administration Source John M. Schleifer

703-789-4481 John.Schleifer@acommsolutions.com

Business Size: Service-Disabled Veteran-Owned Small Business

For more information on ordering from Federal Supply Schedules click on the FSS Schedules button at http://www.fss.gsa.gov.

http://www.gsaadvantage.gov/ http://www.acommsolutions.com/ mailto:John.Schleifer@acommsolutions.com http://www.fss.gsa.gov/

May 5, 2023 3

CUSTOMER INFORMATION

1a. TABLE OF AWARDED SPECIAL ITEM NUMBERS (SINs)

NAICS SIN** DESCRIPTION

541519 54151S IT Professional Services

541519 54151HACS Highly Adaptive Cybersecurity Services Risk and Vulnerability Assessments (RVA)

N/A OLM Order-Level Materials Supplies and/or Services ** Cooperative Purchasing (STLOC)

1b. LOWEST PRICED MODEL NUMBER AND PRICE FOR EACH SIN:

See attached pricelist for details.

1c. HOURLY RATES (Services Only) See attached pricelist for details.

2. MAXIMUM ORDER*

SIN 54151HACS $500,000

SIN 54151S $500,000

OLM $100,000

*If the best value selection places your order over the Maximum Order identified in this catalog/pricelist, you have an opportunity to obtain a better schedule contract price.

Before placing your order, contact the aforementioned contactor for a better price. The contractor may (1) offer a new price for this requirement, (2) offer the lowest price available under this contract or (3) decline the order. A delivery order that exceeds the maximum order may be placed under the schedule contract in accordance with FAR 8.404.

3. MINIMUM ORDER

$100

4. GEOGRAPHIC COVERAGE

Domestic and overseas delivery within the 48 contiguous states, Alaska, Hawaii, Puerto Rico, Washington, DC, and U.S. Territories. Note that for products, domestic delivery also includes a port or consolidation point, within the aforementioned areas, for orders received from overseas activities.

5. POINT(S) OF PRODUCTION

Not applicable.

May 5, 2023 4

6. DISCOUNT FROM LIST PRICES

GSA Net Prices are shown on the attached GSA Pricelist. The negotiated discount has been applied and the IFF has been added.

7. QUANTITY DISCOUNT(S)

1.25% vol. > $300K– 500K; greater than (>) $500,000 subject to negotiation.

8. PROMPT PAYMENT TERMS

1% Net 15 days

9. FOREIGN ITEMS

10a. TIME OF DELIVERY As negotiated at task order level.

10b. EXPEDITED DELIVERY As negotiated at task order level.

10c. OVERNIGHT AND 2-DAY DELIVERY As negotiated on the task order level. Contact the Contractor for rates.

10d. URGENT REQUIRMENTS As negotiated on the task order level. Agencies can contact the Contractor’s representative to affect a faster delivery. Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

11. FOB POINT

Destination.

12a. ORDERING ADDRESS Same as contractor address.

12b. ORDERING PROCEDURES Ordering activities shall use the ordering procedures described in Federal Acquisition Regulation 8.405-3 when placing an order or establishing a BPA for supplies or services.

The ordering procedures, information on Blanket Purchase Agreements (BPA’s) and a sample BPA can be found at the GSA/FSS Schedule Homepage (fss.gsa.gov/schedules).

13. PAYMENT ADDRESS

Same as contractor address.

14. WARRANTY PROVISION

Standard Commercial Warranty. Customer should contact contractor for a copy of the warranty.

May 5, 2023 5

15. EXPORT PACKING CHARGES

16. TERMS AND CONDITIONS OF RENTAL, MAINTENANCE, AND REPAIR

Not Applicable.

17. TERMS AND CONDITIONS OF INSTALLATION

18a. TERMS AND CONDITIONS OF REPAIR PARTS INDICATING DATE OF PARTS

PRICE LISTS AND ANY DISCOUNTS FROM LIST PRICES

Not Applicable

18b. TERMS AND CONDITIONS FOR ANY OTHER SERVICES

19. LIST OF SERVICE AND DISTRIBUTION POINTS

20. LIST OF PARTICIPATING DEALERS

Not Applicable

21. PREVENTIVE MAINTENANCE

22a. SPECIAL ATTRIBUTES SUCH AS ENVIRONMENTAL ATTRIBUTES (e.g. recycled content, energy efficiency, and/or reduced pollutants)

22b. SECTION 508 COMPLIANCE FOR EIT Section 508 compliance information on the supplies and services in this contract are available at the following website address (URL): http://www.acommsolutions.com The EIT standard can be found at www.Section508.gov/.

23. DUNS NUMBER/UNIQUE ENTITY IDENTIFIER (UEI)

080754106/VE4NKB8SJSH8 CAGE CODE: 7WTB5

24. NOTIFICATION REGARDING REGISTRATION IN SYSTEM FOR AWARD

MANAGEMENT (SAM) DATABASE

Contractor has an Active Registration in the SAM database.

http://www.acommsolutions.com/ http://www.section508.gov/

May 5, 2023 6

May 5, 2023 7

TERMS AND CONDITIONS APPLICABLE TO ALL INFORMATION TECHNOLOGY

SERVICES

ORGANIZATIONAL CONFLICTS OF INTEREST

a) Definitions

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or (ii) impair the Contractor’s or its affiliated’ objectivity in performing contract work.

b) To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Example of situations, which may require restrictions, are provided in FAR 9.508.

SERVICES PERFORMED

a) All services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

b) The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity.

c) The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

TRAVEL

Any Contractor travel required in the performance of services must comply with the Pub.

L. 99-234 and FAR Part 31.205-46, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel.

May 5, 2023 8

WARRANTY

a) Unless otherwise specified in this contract, the Contractor’s standard commercial warranty as stated in the contract’s commercial pricelist will apply to this contract.

b) The Contractor’s commercial guarantee/warranty shall be included in the Commercial Supplier Agreement to include the Enterprise User License Agreements or Terms of Services (TOS) agreements, if applicable.

c) Except at otherwise provided by an express or implied warranty, the Contractor will not be liable to the ordering activity for consequential damages resulting from any defect or deficiencies in accepted items.

Regulation Number

Regulation Title/Comments

52.222-46 EVALUATION OF COMPENSATION FOR PROFESSIONAL EMPLOYEES (FEB 1993)

52.222-48 EXEMPTION FROM APPLICATION OF THE SERVICE CONTRACT LABOR STANDARDS TO

CONTRACTS FOR MAINTENANCE, CALIBRATION, OR REPAIR OF CERTAIN EQUIPMENT

CERTIFICATION (MAY 2014)

52.223-19 COMPLIANCE WITH ENVIRONMENTAL MANAGEMENT SYSTEMS (MAY 2011)

52.223-2 AFFIRMATIVE PROCUREMENT OF BIOBASED PRODUCTS UNDER SERVICE AND

CONSTRUCTION CONTRACTS (SEP 2013)

52.229-1 STATE AND LOCAL TAXES (APR 1984)

52.222-62 PAID SICK LEAVE UNDER EXECUTIVE ORDER 13706 (JAN 2017)

52.223-13 ACQUISITION OF EPEAT - REGISTERED IMAGING EQUIPMENT (JUN 2014)

52.223-14 ACQUISITION OF EPEAT® - REGISTERED TELEVISIONS (JUN 2014)

52.223-16 ACQUISITION OF EPEAT® - REGISTERED PERSONAL COMPUTER PRODUCTS (OCT 2015)

552.238-115 SPECIAL ORDERING PROCEDURES FOR THE ACQUISITION OF ORDER-LEVEL MATERIALS

(MAY 2019)

552.238-107 TRAFFIC RELEASE (SUPPLIES) (MAY 2019)

552.238-73 IDENTIFICATION OF ELECTRONIC OFFICE EQUIPMENT PROVIDING ACCESSIBILITY FOR

THE

HANDICAPPED (MAY 2019)

552.238-86 DELIVERY SCHEDULE (MAY 2019)

552.238-89 DELIVERIES TO THE U.S. POSTAL SERVICE (MAY 2019)

552.238-90 CHARACTERISTICS OF ELECTRIC CURRENT (MAY 2019)

552.238-91 MARKING AND DOCUMENTATION REQUIREMENTS FOR SHIPPING (MAY 2019)

552.238-92 VENDOR MANAGED INVENTORY (VMI) PROGRAM (MAY 2019)

552.238-93 ORDER ACKNOWLEDGMENT (MAY 2019)

552.238-94 ACCELERATED DELIVERY REQUIREMENTS (MAY 2019)

May 5, 2023 9

TERMS AND CONDITIONS APPLICABLE TO HIGHLY ADAPTIVE CYBERSECURITY

SERVICES (HACS) (SIN 54151HACS)

****NOTE: Non-professional labor categories must be incidental to, and used solely to support Highly Adaptive Cybersecurity Services, and cannot be purchased separately.

Further, non-professional labor categories shall be offered under SIN ANCILLARY only.

****NOTE: Labor categories under the Special Item Number 54151S Information Technology Professional Services may remain under SIN 54151S unless the labor categories are specific to the Highly Adaptive Cybersecurity Services SINs.

SCOPE

****NOTE: SUBJECT TO COOPERATIVE PURCHASING

54151HACS includes a wide range of fields such as, the seven-step Risk Management Framework services, information assurance, virus detection, network management, situational awareness and incident response, secure web hosting, and backup, security services and Security Operations Center (SOC) services. HACS vendors are cataloged under the five (5) subcategories of High Value Asset Assessments; Risk and Vulnerability Assessments; Cyber Hunt; Incident Response; and Penetration Testing.

54151HACS includes proactive and reactive cybersecurity services that improve the customer’s enterprise-level security posture. Services to identify and protect a customer’s information resources, detect and respond to cybersecurity events or incidents, and recover capabilities or services impaired by any incidents that emerge.

The scope of this category encompasses a wide range of fields that include, but are not limited to, Risk Management Framework (RMF) services, information assurance (IA), virus detection, network management, situational awareness and incident response, secure web hosting, and backup and security services.

The seven-step RMF includes preparation, information security categorization; control selection, implementation, and assessment; system and common control authorizations;

and continuous monitoring. RMF activities may also include Information Security Continuous Monitoring Assessment (ISCMA) which evaluate organization-wide ISCM implementations, and also Federal Incident Response Evaluations (FIREs), which assess an organization’s incident management functions.

The scope of this category also includes Security Operations Center (SOC) services. The SOC scope includes services such as: 24x7x365 monitoring and analysis, traffic analysis, incident response and coordination, penetration testing, anti-virus management, intrusion detection and prevention, and information sharing.

HACS vendors are able to identify and protect a customer’s information resources, detect and respond to cybersecurity events or incidents, and recover capabilities or services impaired by any incidents that emerge.

SUB-CATEGORIES

High Value Asset (HVA) Assessments include Risk and Vulnerability Assessment

May 5, 2023 10

(RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing. Security Architecture Review (SAR) evaluates a subset of the agency’s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems. SAR provides a holistic analysis of how an HVA’s individual security components integrate and operate, including how data is protected during operations. Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on but is not limited to the following security areas: perimeter security, network security, endpoint security, application security, physical security, and data security.

Risk and Vulnerability Assessment (RVA) assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing.

Penetration Testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

Incident Response services help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.

Cyber Hunt activities respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunts start with the premise that threat actors known to target some organizations in a specific industry or with specific systems are likely to also target other organizations in the same industry or with the same systems.

The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

Vendor suitability for offering services through the Highly Adaptive Cybersecurity Services (HACS) SIN must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

May 5, 2023 11

Federal Acquisition Regulation (FAR) Part 52.204-21 OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of

Personally Identifiable Information (PII) OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program 2017 Report to the President on Federal IT Modernization The Cybersecurity National Action Plan (CNAP) NIST SP 800-14 - Generally Accepted Principles and Practices for Securing

Information Technology Systems NIST SP 800-27A - Engineering Principles for Information Technology Security (A

Baseline for Achieving Security) NIST SP 800-30 - Guide for Conducting Risk Assessments NIST SP 800-35 - Guide to Information Technology Security Services NIST SP 800-37 - Risk Management Framework for Information Systems and

Organizations: A Systems Life Cycle Approach for Security and Privacy NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and

Information System View NIST SP 800-44 - Guidelines on Securing Public Web Servers NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and

Organizations NIST SP 800-61 - Computer Security Incident Handling Guide NIST SP 800-64 - Security Considerations in the System Development Life Cycle NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment NIST SP 800-128 - Guide for Security-Focused Configuration Management of

Information Systems NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs) NIST SP 800-160 - Systems Security Engineering: Considerations for a

Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal

Information Systems and Organizations

ORDER

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket Purchase Agreements, individual purchase orders, or task orders for ordering services under this contract. Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made, and the contract terms and conditions shall continue in effect until the completion of the order.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

May 5, 2023 12

INSPECTION OF SERVICES

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND

CONDITIONS – COMMERCIAL ITEMS (OCT 2018) (DEVIATION FEB 2018) &

(ALTERNATE I - JAN 2017) (DEVIATION – FEB 2007) for Time-and-Materials and Labor- Hour orders placed under this contract.

RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to the ordering activity security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Highly Adaptive Cybersecurity Services.

INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for Highly Adaptive Cybersecurity Services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

DESCRIPTION OF HIGHLY ADAPTIVE CYBERSECURITY SERVICES AND PRICING

a. The Contractor shall provide a description of each type of Highly Adaptive Cybersecurity Service offered under Special Item Number 54151HACS for Highly Adaptive Cybersecurity Services and it should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

b. Pricing for all Highly Adaptive Cybersecurity Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates, minimum general experience and minimum education.

May 5, 2023 13

TERMS AND CONDITIONS APPLICABLE TO INFORMATION TECHNOLOGY (IT)

PROFESSIONAL SERVICES (SIN 54151S)

****NOTE: All non-professional labor categories must be incidental to, and used solely to support professional services, and cannot be purchased separately. Further, non-professional labor categories shall be offered under SIN ANCILLARY only.

SCOPE

****NOTE: SUBJECT TO COOPERATIVE PURCHASING

54151S IT Professional Services and/or labor categories for database planning and design; system analysis, integration, and design; programming, conversion and implementation support; network services, data/records management, and testing.

ORDER

a. Agencies may use written orders, EDI orders, blanket purchase agreements, individual purchase orders, or task orders for ordering services under this contract.

Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made, and the contract terms and conditions shall continue in effect until the completion of the order.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

INSPECTION OF SERVICES

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND

CONDITIONS – COMMERCIAL ITEMS (OCT 2018) (DEVIATION FEB 2018) &

(ALTERNATE I - JAN 2017) (DEVIATION – FEB 2007) for Time-and-Materials and Labor- Hour orders placed under this contract.

RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite IT Professional Services.

INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for IT Professional services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity's Contracting Officer, written consent before placing any subcontract for furnishing any of

May 5, 2023 14 the work called for in a task order.

DESCRIPTION OF IT PROFESSIONAL SERVICES AND PRICING

a. The Contractor shall provide a description of each type of IT Service offered under Special Item Numbers 54151S Professional Services should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

b. Pricing for all IT Professional Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates, monthly rates, term rates, and/or fixed prices, minimum general experience and minimum education.

May 5, 2023 15

TERMS AND CONDITIONS APPLICABLE TO ORDER-LEVEL MATERIALS (OLMS)

- SUPPLIES AND/OR SERVICES (SIN OLM)

Order-Level Materials (OLMs) are supplies and/or services acquired in direct support of an individual task or delivery order placed against a Federal Supply Schedule (FSS) contract or FSS blanket purchase agreement (BPA). OLMs are not defined, priced, or awarded at the FSS contract level. They are unknown before a task or delivery order is placed against the FSS contract or FSS BPA. OLMs are only authorized for inclusion at the order level under Time-and-Materials (T&M) or Labor-Hour (LH) Contract Line Item Number (CLIN) and are subject to a Not to Exceed (NTE) ceiling price. OLMs include direct materials, subcontracts for supplies and incidental services for which there is not a labor category specified in the FSS contract, other direct costs (separate from those under ODC SINs), and indirect costs. OLMs are purchased under the authority of the FSS Program and are not "open market items." Items awarded under ancillary supplies/services or other direct cost (ODC) SINs are not OLMs. These items are defined, priced, and awarded at the FSS contract level, whereas OLMs are unknown before an order is placed. Ancillary supplies/services and ODC SINs are for use under all order type CLINs (Fixed-Price (FP), T&M, and LH), whereas the Order-Level Materials SIN is only authorized for use under T&M and LH order CLINs.

The Order-Level Materials SIN is only authorized for use in direct support of another awarded SIN. OLMs are defined and priced at the ordering activity level in accordance with GSAR clause 552.238-82 Special Ordering Procedures for the Acquisition of Order- Level Materials. Prices for items provided under the Order-Level Materials SIN must be inclusive of the Industrial Funding Fee (IFF). The cumulative value of OLMs in an individual task or delivery order cannot exceed 33.33% of the total value of the order.

NOTE: Additional information, and the Order-Level Materials Vendor Webinar – Training Slides and FAQ Interact Post can be found at the following links: - www.gsa.gov/olm and https://interact.gsa.gov/document/order-level-materials-vendor-webinar-training-slides-and-faq

ORDER PLACEMENT CONSIDERATIONS:

Orders must comply with clause 552.238-82 Special Ordering Procedures for the Acquisition of Order-Level Materials.

OLMs are only authorized for inclusion under select Federal Supply Schedules. A list of authorized Schedules is maintained at www.gsa.gov/olm.

OLMs must only be acquired in direct support of an individual task or delivery order and not as the primary basis or purpose of the order.

OLMs are only authorized for inclusion under a T&M or LH CLIN. However, FAR 8.404(h)(2) requires agencies to use FP orders to the maximum extent practicable.

Therefore, when use of OLMs under a T&M or LH CLIN is contemplated, requirements should be structured to maximize the use of FP CLIN(s) to maximum extent practicable. This may result in a “hybrid” order that, despite having T&M or LH elements, is classified as FP for reporting purposes.

All OLMs must be acquired via the OLM SIN. This includes cases when OLMs are http://www.gsa.gov/olm http://www.gsa.gov/olm

May 5, 2023 16 included in hybrid orders, e.g., FP orders that include a T&M/LH OLM CLIN.

Prior to placement of an order that includes OLMs, the ordering activity CO shall follow procedures in FAR 8.404(h). A determinations and findings (D&F) is required for the T&M or LH portion of the order, regardless of dollar value. A sample D&F, which must be tailored to the specific circumstances of the requirement, is provided in Attachment #2.

A separate CLIN for OLMs should be established for monitoring the cumulative value of OLMs in orders.

The cumulative value of OLMs in an individual task or delivery order must not exceed 33.33% (⅓) of the total value of the order. “Total value” is defined as the anticipated or recorded dollar value of contract items at time of order award, inclusive of option periods. OLMs, including IFF, are contract items for that order.

Travel costs and open market items are excluded from the total value calculation.

Travel, while considered an OLM by definition6, is exempt from the three-quotes requirement, does not count toward the 33.33% cap, and is exempt from the IFF clause (see (d)(11) of clause 552.238-82). Travel costs are governed by FAR 31.205-46 Travel costs, which addresses Federal Travel Regulations, Joint Travel Regulation, and Standardized Regulations (Government Civilians, Foreign Areas).

Since travel is handled differently than other OLMs, the ordering activity CO should consider establishing a separate CLIN for travel.

The ordering activity CO should verify that the OLM SIN is awarded on a vendor’s FSS contract prior to order placement. Contractors that have not been awarded the OLM SIN are not authorized to receive orders that include OLMs.

The ordering activity CO is responsible for – o Defining any known OLM categories (e.g., computer usage charges) o Establishing a not-to-exceed (NTE) ceiling price for OLMs and determining the ceiling fair and reasonable o Approving proposed OLM indirect cost fixed amount and determining it is fair and reasonable (if applicable)

For each proposed OLM item that exceeds the Simplified Acquisition Threshold, the contractor is required to obtain a minimum of three (3) quotes to support the price reasonableness of the item (see (d)(7)(i) of clause 552.238-82 for more information).

If three quotes cannot be obtained, the contractor is required to maintain documentation of the reason.

A contractor with an approved purchasing system per FAR 44.3 is exempt from the requirement to obtain three quotes.

The three quotes obtained by the contractor are documented internally and subject to audit.

May 5, 2023 17

The ordering activity CO must make an independent determination that prices for all proposed OLMs are fair and reasonable. This determination must be documented in the contract file and can be based on a comparison of quotes received in response to the RFQ or other relevant pricing information (e.g., data from horizontal price analysis tools, such as 4P). However, the ordering activity CO shall not request access to the three quotes obtained by the contractor except as a last resort, when all other attempts at determining price reasonableness have been exhausted. When the ordering activity CO determines it necessary to request access to this information, the ordering activity CO shall document the rationale in the contract file.

OLMs are negotiated with an NTE price ceiling the contractor exceeds at its own risk.

In accordance with clause 552.212-4 (JAN 2017) (Deviation - FEB 2007) (Deviation -

FEB 2018) (ALTERNATE I - JAN 2017) each order must list separately a.)

subcontracts for services excluded from the FSS Hourly Rates, b.) the elements of other direct costs, and c.) the fixed amount for the indirect costs and payment schedule (or if no indirect costs are approved, insert “none”).

The “subcontracts for services excluded from the FSS Hourly Rates” referenced in 552.212-4(e)(iii)(D) are reserved for services that are not part of the FSS contract, can only be determined at the order level (i.e., they cannot be defined/established at the FSS contract level), and are incidental to the work being performed under the order.

The ordering activity CO determines whether to allow indirect costs not included in the FSS hourly rate. For example, the contractor may request approval of indirect costs associated with providing OLMs. Proposed indirect costs must be inclusive of the IFF. Proposed indirect costs must be a fixed amount and not a percentage of the cost.

If indirect costs are approved (per clause 552.212-4 (JAN 2017) (Deviation - FEB 2007) (Deviation - FEB 2018) (ALTERNATE I - JAN 2017) - see (i)(1)(ii)(D)(2)), the ordering activity CO must make a determination that all indirect costs approved for payment are fair and reasonable. The ordering activity CO may request supporting data from the contractor as needed.

ORDER ADMINISTRATION CONSIDERATIONS:

If it becomes necessary to increase the ceiling price of the OLM order CLIN, the ordering activity CO must comply with the requirements at FAR 8.404(h)(3)(iv).

The ordering activity CO must closely monitor the order to ensure continued contractor compliance with OLM authority, to include monitoring the OLM CLIN to ensure that the cumulative value of OLMs does not exceed 33.33% (⅓) of the total value of the order.

Since OLMs by definition are unknown at the time of BPA establishment, the flexibility to acquire OLMs to support individual orders may be within the scope of existing FSS BPAs — provided that the underlying FSS contract includes the OLM SIN.

Ordering COs will have to determine if the OLM SIN (and products or services to

May 5, 2023 18 be procured under it) are within the scope of the underlying BPA. Utilizing the OLM flexibility for new BPA orders shall not alter the primary purpose or scope of the BPA, as OLMs may only be acquired in direct support of work performed under existing BPA SINs.

1. LABOR CATEGORY INFORMATION

1.1 EXPERIENCE SUBSTITUTIONS

Substitution Methodology: Due to the availability or limitation of education, occasionally substitution of experience as referenced below for a professional labor type with additional years of experience will be provided to the Federal Agency when responding to their IT requirements and it is solely the acquiring agency’s determination, if the substitution is considered acceptable prior to an award.

ACTUAL

EDUCATION

REQUIRED

EDUCATION

ADDITIONAL YEARS OF EXPERIENCE NEEDED FOR

EDUCATIONAL REQUIREMENTS EQUIVALENCY

HS/GED BA/BS 4

HS/GED MA/MS 6

HS/GED Ph.D. No equivalency

BA/BS MA/MS 2

BA/BS Ph.D. No equivalency MA/MS Ph.D. 4

Approved training programs include, but are not limited to, CCNT, CIPTS, Microsoft, Cisco, Oracle, DEC, Marconi, Nortel, and SUN Microsystems certificate programs.

May 5, 2023 19

1.2 ACS LABOR CATEGORY DESCRIPTIONS

ITEM

NO.

54151S / 54151HACS

LABOR CATEGORY

MINIMUM EDUCATION

(APPLICABLE TO IT

AND CYBER

FUNCTIONAL RESPONSIBILITY MINIMUM

EXPERIENCE

Technician

Associates Degree Installs and repairs electrical or electronic equipment, and performs on-site post-installation repair, calibration, and maintenance as scheduled or required, applying knowledge of electronics, electrical circuits, mechanics, pneumatics, hydraulics, and programming. Checks work orders and related manuals, blueprints, and schematic diagrams to determine tasks to be performed and tools, equipment, and parts needed for installation of repair assignment. Conducts site surveys; assesses and documents current site configuration and user requirements and installs new configurations such as operations system, databases, networking technologies, server technologies as well as intrusion detection systems.

1 Years

Systems Analyst I

Associates Degree;

Additional security related certificates might be required (i.e., CISSP, CompTIA Security+, C|EH, ITIL)

Analyzes and solves computer problems, and assures technology meets the needs of the organization. Implements system studies to assist organization to realize maximum benefit from investments in equipment, personnel, and business processes. Plans and designs new computer systems and devises ways to apply existing systems resources to additional operations. Security related duties might include providing for: planning; analyzing; designing;

developing; documenting; test, training, and exercise (TT&E);

operating; measuring/reporting; and/or administering cybersecurity systems, processes and procedures, support infrastructure, capabilities, and programs. Defines and interprets strategic requirements, analyzes and provides guidance, and executes cyber mission tasks including analysis support to penetration testing, incident response activities, cyber hunt activities, and risk and vulnerability assessments. Proficiency/skill with security focused topics, to include vulnerability research, offensive and defensive hacking methods, encryption, and other security related topics.

3 Years

May 5, 2023 20

54151S / 54151HACS

LABOR CATEGORY

MINIMUM EDUCATION

Systems Analyst II

Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other scientific or technical discipline directly related to the work being supported;

Additional security related certificates might be required (i.e., CISSP, CompTIA Security+, C|EH, ITIL)

Analyzes and solves computer problems, and assures technology meets the needs of the organization. Implements system studies to assist organization to realize maximum benefit from investments in equipment, personnel, and business processes. Plans and designs new computer systems and devises ways to apply existing systems resources to additional operations. Security related duties might include providing for: planning; analyzing; designing;

developing; documenting; test, training, and exercise (TT&E);

operating; measuring/reporting; and/or administering cybersecurity systems, processes and procedures, support infrastructure, capabilities, and programs. Defines and interprets strategic requirements, analyzes and provides guidance, and executes cyber mission tasks including analysis support to penetration testing, incident response activities, cyber hunt activities, and risk and vulnerability assessments. Proficiency/skill with security focused topics, to include vulnerability research, offensive and defensive hacking methods, encryption, and other security related topics.

8 Years

May 5, 2023 21

54151S / 54151HACS

LABOR CATEGORY

MINIMUM EDUCATION

Information Specialist I

Computer Science, Information Systems, Engineering, Business, or other scientific or technical discipline directly related to the work being supported;

Additional security related certificates might be required (i.e., CISSP, CompTIA Security+, C|EH, ITIL)

Assists in the design and production of new technology initiatives such as website, databases, or electronic discussion groups. Applies systems analysis techniques to define and develop information systems, including application requirements and system alternative solutions. Supports development of system requirements, program specifications, and implements the selected system. Applies knowledge of hardware, software, and user needs in the design of information system elements. Designs, develops, engineers, and implements security solutions. Gathers and organizes technical information about an organization’s mission, goals, and needs; existing security products; and ongoing programs.

Develops, analyzes, and implements security architecture(s) as appropriate. Performs risk analysis and security audit services, develops analytical reports as required. May be required to perform in one or more of the following areas: risk assessment methods and procedures; security of system software generation; security of computer hardware;

operating system utility/support software; disaster recovery, incident response, application assessment, vulnerability threat management, cloud security, and contingency planning;

telecommunications security; development of security policies and procedures.

3 Years

May 5, 2023 22

54151S / 54151HACS

LABOR CATEGORY

MINIMUM EDUCATION

Information Specialist II

Computer Science, Information Systems, Engineering, Business, or other scientific or technical discipline directly related to the work being supported;

Additional security related certificates might be required (i.e., CISSP, CompTIA Security+, C|EH, ITIL)

Applies sophisticated systems engineering and analysis techniques to define and develop complex information systems on multiple platforms and development environments. Conducts feasibility studies to determine new or changed procedures or applications of information technology in particular system functional areas. Defines functional requirements and oversees/conducts system testing and implementation. Combines expert knowledge of hardware, software, and user needs in the design of a complete information system. Provides technical direction to members of the project team. Responsible for overseeing the design and development of entire, large information systems.

Designs, develops, engineers, and implements security solutions. Gathers and organizes technical information about an organization’s mission, goals, and needs; existing security products; and ongoing programs. Develops, analyzes, and implements security architecture(s) as appropriate. Performs risk analysis and security audit services, develops analytical reports as required. May be required to perform in one or more of the following areas: risk assessment methods and procedures; security of system software generation; security of computer hardware; operating system utility/support software; disaster recovery, incident response, application assessment, vulnerability threat management, cloud security, and contingency planning; telecommunications security;

development of security policies and procedures.

5 Years

Technical Writer

Computer Science, Information Systems, Engineering, Business, or other scientific or technical discipline directly related to the work being supported

Writes and updates material for reports, manuals, briefs, proposals, instruction books, catalogs, and related technical and administrative publications concerned with work methods and procedures, and installation, operation, and maintenance.

Security related duties might include deliverables needed for clients' final cybersecurity reports.

May 5, 2023 23

54151S / 54151HACS

LABOR CATEGORY

MINIMUM EDUCATION

Engineer

Computer Science, Information Systems, Engineering, Business, or other scientific or technical discipline directly related to the work being supported;

Additional security related certificates might be required (i.e., CISSP, CompTIA Security+, C|EH, ITIL)

Plans, designs, and evaluates new and existing network systems and computer software, providing analytical, technical, and administrative support. Plans, oversees, develops, and implements network policies and procedures and ensures network integrity as maintenance and modification projects to existing applications are undertaken.

Utilizes advance knowledge in the field of computer science or software engineering along with advanced knowledge of software development and methodologies. Security related duties might include conducting and/or supporting security/penetration testing on enterprise network assets, incident response activities including collection and correlation of incident data for mitigation and remediation, cyber hunt activities, threat and vulnerability assessments, analysis and evaluation of Computer Network Defense policies and configurations, and evaluation for compliance with regulations and enterprise directives. Possesses in-depth knowledge of principles, concepts, and techniques appropriate to the development, operation of systems, and procedures dealing with real-time security monitoring, response, containment, investigation, and remediation;

identification of flaws and weaknesses in the systems;

prioritization of security resources; information security/assurance; resources and facilities management, database planning and design, systems analysis and design, network services, programming, conversion and implementation support, network services project management, data/records management, and other computer-related services. Follows established procedures and contributes to the completion of milestones associated with specific projects and security testing principles, tools, and techniques; general attack stages; and identification of systemic security issues.

May 5, 2023 24

54151S / 54151HACS

LABOR CATEGORY

MINIMUM EDUCATION

Senior Engineer

Computer Science, Information Systems, Engineering, Business, or other scientific or technical discipline directly related to the work being supported

Plans, designs, and evaluates new and existing network systems and computer software, providing analytical, technical, and administrative support. Plans, oversees, develops, and implements network policies and procedures and ensures network integrity as maintenance and modification projects to existing applications are undertaken.

Utilizes advance knowledge in the field of computer science or software engineering along with advanced knowledge of software development and methodologies. Security related duties might include conducting and/or supporting security/penetration testing on enterprise network assets, incident response activities including collection and correlation of incident data for mitigation and remediation, cyber hunt activities, threat and vulnerability assessments, analysis and evaluation of Computer Network Defense policies and configurations, and evaluation for compliance with regulations and enterprise directives. Possesses in-depth knowledge of principles, concepts, and techniques appropriate to the development, operation of systems, and procedures dealing with real-time security monitoring, response, containment, investigation, and remediation;

identification of flaws and weaknesses in the systems;

prioritization of security resources; information security/assurance; resources and facilities management, database planning and design, systems analysis and design, network services, programming, conversion and implementation support, network services project management, data/records management, and other computer-related services. Provides analysis on a wide range of requirements related to security testing principles, tools, and techniques; general attack stages; and identification of systemic security issues.

8 Years

May 5, 2023 25

54151S / 54151HACS

LABOR CATEGORY

MINIMUM EDUCATION

Solutions Architect

Computer Science, Information Systems, Engineering, Business, or other scientific or technical discipline directly related to the work being supported

Designs, presents and administers integrated technology solutions architecture, strategies, policies and standards.

Coordinates and oversees architecture implementation and modification activities. Security related duties might include conducting and/or supporting security/penetration testing on enterprise network assets, incident response activities including collection and correlation of incident data for mitigation and remediation, cyber hunt activates, threat and vulnerability assessments, analysis and evaluation of Computer Network Defense policies and configurations, and evaluation for compliance with regulations and enterprise directives. Possesses in-depth knowledge of principles, concepts, and techniques appropriate to the development, operation of systems, and procedures dealing with real-time security monitoring, response, containment, investigation, and remediation; identification of flaws and weaknesses in the systems; prioritization of security resources; information security/assurance; resources and facilities management, database planning and design, systems analysis and design, network services, programming, conversion and implementation support, network services project management, data/records management, and other computer-related services. Interprets requirements, performs highly complex analysis, and resolves complex problems related to security testing principles, tools, and techniques;

general attack stages; and identification of systemic security issues.

10 Years

May 5, 2023 26

54151S / 54151HACS

LABOR CATEGORY

MINIMUM EDUCATION

Senior Solutions Architect

Master’s degree in Computer Science, Information Systems, Engineering, Business, or other scientific or technical discipline directly related to the work being supported;

Additional security related certificates might be required (i.e., CISSP, CompTIA Security+, C|EH, ITIL)

Applies advanced analysis skills and experience in principals of solutions design to define appropriate client solution, scope the effort, and provide technical leadership. Responsible for the overall design of the solution and mapping client business requirements to systems/technical requirements to provide a complete client solution. Security related duties might include lead and/or support security/penetration testing on enterprise network assets, incident response activities including collection and correlation of incident data for mitigation and remediation, cyber hunt activities, threat and vulnerability assessments, analysis and evaluation of Computer Network Defense policies and configurations, and evaluation for compliance with regulations and enterprise directives.

Possesses in-depth knowledge of principles, concepts, and techniques appropriate to the development, operation of systems, and procedures dealing with real-time security monitoring, response, containment, investigation, and remediation; identification of flaws and weaknesses in the systems; prioritization of security resources; information security/assurance; resources and facilities management, database planning and design, systems analysis and design, network services, programming, conversion and implementation support, network services project management, data/records management, and other computer-related services. Interprets requirements, performs highly complex analysis, and resolves complex problems related to security testing principles, tools, and techniques;

general attack stages; and identification of systemic security issues.

15 Years

May 5, 2023 27

54151S / 54151HACS

LABOR CATEGORY

MINIMUM EDUCATION

Project Manager

Computer Science, Information Systems, Engineering, Business, or other scientific or technical discipline directly related to the work being supported

Manages, coordinates, and establishes priorities for complete life-cycle of projects including the planning, design, programming, testing, and implementation of business solutions designed to meet requirements of various departments…