MAS - Dakota Consulting Incorporated - 47QTCA19D00HQ

General Services Administration Federal Supply Service

Authorized Federal Supply Schedule Price List

Online access to contract ordering information, terms and conditions, up to date pricing, and the option to create an electronic delivery order are available through GSA Advantage!®, a menu driven database system. The INTERNET address GSA Advantage!® is: GSAAdvantage.gov.

Schedule Title: Multiple Award Schedule (MAS)

FSC Group: MAS

Contract Number: 47QTCA19D00HQ Pricelist current through Modification # PS-0011, dated July 1, 2021

For more information on ordering from Federal Supply Schedules click on FSS Schedules at GSA.gov.

Contract Period: August 14, 2019 – August 13, 2024

Company:

1110 Bonifant Street, Suite 310 | Silver Spring, MD 20910-3358

Office: (240) 839-7812 | Fax: (240) 254-3186 E-mail: GSA-Orders@Dakota-Consulting.com

DUNS No.: 16-892-6264

Website: www.Dakota-Consulting.com

Contract Administrator:

Kimberly Simmons

1110 Bonifant Street, Suite 310 Silver Spring, MD 20910

Kimberly.simmons@dakota-consulting.com 240-645-0229

Business Size: Small Business

Prices Shown Herein Are Net (discount deducted mailto:Kimberly.simmons@dakota-consulting.com

CUSTOMER INFORMATION

1a Table of awarded special item number(s)

SIN SIN Title

54451S

Information Technology (IT) Professional Services

54151HACS

Highly Adaptive Cybersecurity Services (HACS)

OLM

Order-Level Materials (OLMs)

1b . Lowest Priced Model Number and Price for Each Awarded SIN

The labor rates in the price list are the Government price based on a unit of one labor hour, exclusive on any quantity / dollar volume, prompt payment, or any other concession. Rates are not based on geographic location.

54151S Application Programmer - I $71.87

54151HACS Cybersecurity Consultant - I $99.87

1c Hourly Rates (Services only)

Labor Category Descriptions, experience and education requirements are located in Sections 2 and 3.

2. Maximum order:

a) The Maximum Order value for the following Special Item Numbers (SINs) is $500,000: Special Item Number 54151HACS – Highly Adaptive Cybersecurity Services (HACS)

(b) The Maximum Order value for the following Special Item Numbers (SINs) is $500,000: Special Item Number 54151S – Information Technology Professional Services

(c ) The Maximum Order value for the following Special Item Numbers (SINs) is $100,000: Special Item Number OLM – Order-Level Materials

3. Minimum order:

The minimum dollar value of orders to be issued is $100.00.

4. Geographic coverage (delivery area):

Domestic delivery is delivery within the 48 contiguous states, Alaska, Hawaii, Puerto Rico, Washington, DC, and US Territories. Domestic delivery also includes a port or consolidation point, within the aforementioned areas, for orders received from overseas activities.

Overseas delivery is delivery to points outside of the 48 contiguous states, Washington, DC, Alaska, Hawaii, Puerto Rico, and US Territories.

Offerors are requested to check one of the following boxes:

[ ] The Geographic Scope of Contract will be domestic and overseas delivery.

[ ] The Geographic Scope of Contract will be overseas delivery only.

[X] The Geographic Scope of Contract will be domestic delivery only.

Contract#: 47QTCA19D00HQ

5. Point(s) of production: Services herein can originate at any CONUS location.

6. Discount from list prices or statement of net price:

Prices shown are NET Prices; Basic Discounts have been deducted. Government Education Institutions are offered the same discounts as all other Government customers.

7. Quantity discounts: None

8. Prompt payment terms: None

Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions.

8(a) Government Purchase Cards Below the Micro-purchase Threshold

Government commercial purchase cards are accepted at or below the micro-purchase threshold.

8(b) Government Purchase Cards Above the Micro-purchase Threshold

Government commercial purchase cards are not accepted above the micro-purchase threshold.

9. Foreign items: None

10a. Time of delivery:

The Contractor shall deliver to destination within the number of calendar days after receipt of order (ARO), as set forth below:

Table 1-2. Times of Delivery

SPECIAL ITEM NUMBER DELIVERY TIME (Days ARO)

54151S To be determined between Dakota Consulting, Inc. and the Ordering Activity at the time that the order is placed.

54151HACS See above.

OLM See above.

10b. Expedited delivery:

“Items available for expedited delivery are noted in this price list

10c. Overnight and 2 day delivery:

Not Available

10d. Urgent Requirements:

I-FSS-140-B – URGENT REQUIREMENTS (JAN 1994)

When the Federal Supply Schedule contract delivery period does not meet the bona fide urgent delivery requirements of an ordering agency, agencies are encouraged, if time permits, to contact the Contractor for the purpose of obtaining accelerated delivery. The Contractor shall reply to the inquiry within 3 workdays after receipt. (Telephonic replies shall be confirmed by the Contractor in writing.) If the Contractor offers an accelerated delivery time acceptable to the ordering agency, any order(s) placed pursuant to the agreed upon accelerated delivery time frame shall be delivered within this shorter delivery time and in accordance with all other terms and conditions of the contract.

Agencies can contact the Contractor’s representative to affect a faster delivery. Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

11. F.O.B point(s):

CONUS – 48 Contiguous States and District of Columbia

12a. Ordering address(es):

Dakota Consulting, Inc.

1110 Bonifant Street, Suite 310 Silver Spring, MD 20910-3358

The following telephone number(s) can be used by ordering activities to obtain technical and/or ordering assistance:

Telephone: (240) 839-7812 Fax: (240) 254-3186 Email: GSA-Orders@Dakota-Consulting.com

12b. Ordering procedures:

For supplies and services, the ordering procedures, information on Blanket Purchase Agreements (BPA’s) are found in Federal Acquisition Regulation (FAR) 8.405-3.

Payment address(es):

Dakota Consulting, Inc.

1110 Bonifant Street, Suite 310 Silver Spring, MD 20910-3358

The following telephone number(s) can be used by ordering activities to obtain technical and/or ordering assistance:

Telephone: (240) 839-7812 Fax: (240) 254-3186 Email: GSA-Orders@Dakota-Consulting.com

Warranty provision:

Contractor’s standard warranty.

Export packing charges: Not Applicable

Terms and conditions of rental, maintenance, and repair: Not Applicable mailto:GSA-Orders@Dakota-Consulting.com mailto:GSA-Orders@Dakota-Consulting.com

Terms and conditions of installation: Not Applicable

18a. Terms and conditions of repair parts: Not Applicable

18b. Terms and conditions for any other services: Not Applicable

19. List of service and distribution points: Not Applicable

20. List of participating dealers: Not Applicable

21. Preventive maintenance: Not Applicable

22a. Special attributes: Not Applicable

22b. Section 508 compliance:

If applicable, Section 508 compliance information on the supplies and services in this contract are available in Electronic and Information Technology (EIT) at the following:

www.Dakota-Consulting.com

The EIT standard can be found at: www.Section508.gov/.

Data Universal Number System (DUNS) number: 16-892-6264

Notification regarding registration in System for Award Management (SAM) database:

Dakota Consulting, Inc. maintains an active SAM registration and has completed applicable representations and certifications.

http://www.section508.gov/

TERMS AND CONDITIONS APPLICABLE TO

ORDER LEVEL MATERIALS (SIN OLM)

Order-Level Materials (OLMs) are supplies and/or services acquired in direct support of an individual task or delivery order placed against a Federal Supply Schedule (FSS) contract or FSS blanket purchase agreement (BPA). OLMs are not defined, priced, or awarded at the FSS contract level. They are unknown before a task or delivery order is placed against the FSS contract or FSS BPA. OLMs are only authorized for inclusion at the order level under a Time-and-Materials (T&M) or Labor-Hour (LH) Contract Line Item Number (CLIN) and are subject to a Not To Exceed (NTE) ceiling price. OLMs include direct materials, subcontracts for supplies and incidental services for which there is not a labor category specified in the FSS contract, other direct costs (separate from those under ODC SINs), and indirect costs. OLMs are purchased under the authority of the FSS Program and are not “open market items.”

Items awarded under ancillary supplies / services or other direct cost (ODC) SINs are not OLMs. These items are defined, priced, and awarded at the FSS contract level, whereas OLMs are unknown before an order is placed. Ancillary supplies / services and ODC SINs are for use under all order type CLINs (Fixed- Price [FP], T&M, and LH), whereas the Order-Level Materials SIN is only authorized for use under T&M and LH order CLINs.

The Order-Level Materials SIN is only authorized for use in direct support of another awarded SIN. Price analysis for OLMs is not conducted when awarding the FSS contract or FSS BPA; therefore, GSAR

538.270 and 538.271 do not apply to OLMs. OLMs are defined and priced at the ordering activity level in accordance with GSAR clause 552.238-82 Special Ordering Procedures for the Acquisition of Order- Level Materials. Prices for items provided under the Order-Level Materials SIN must be inclusive of the Industrial Funding Fee (IFF). The cumulative value of OLMs in an individual task or delivery order cannot exceed 33.33% of the total value of the order. The Maximum Order Threshold for the OLM SINs is $100,000. See clauses 552.212-4 Contract Terms and Conditions – Commercial Items (JAN 2017) (Deviation – FEB 2018) (Alternate I – JAN 2017) (Deviation – FEB 2007) and 552.238-82 Special Ordering Procedures for the Acquisition of Order-Level Materials (JAN 2018) for additional information on inclusion of OLMs in task and delivery orders placed against an FSS contract or BPA. OLMs are only authorized for inclusion at the order level under a T&M or LH CLIN and are subject to an NTE ceiling price. The Order-Level Materials SIN contains no items or pricing, since by definition OLMs are unknown at the time of FSS contract award. The ordering activity contracting officer is responsible for defining OLMs and determining proposed OLM pricing fair and reasonable for a particular order.

TERMS AND CONDITIONS APPLICABLE TO HIGHLY ADAPTIVE CYBERSECURITY SERVICES

(HACS)

(SPECIAL ITEM NUMBER 54151HACS)

Vendor suitability for offering services through the Highly Adaptive Cybersecurity Services (HACS) SIN must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

Federal Acquisition Regulation (FAR) Part 52.204-21

OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of Personally Identifiable Information (PII)

OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program

2017 Report to the President on Federal IT Modernization

The Cybersecurity National Action Plan (CNAP)

NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology Systems

NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security)

NIST SP 800-30 - Guide for Conducting Risk Assessments

NIST SP 800-35 - Guide to Information Technology Security Services

NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations: A Systems Life Cycle Approach for Security and Privacy

NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View

NIST SP 800-44 - Guidelines on Securing Public Web Servers

NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

NIST SP 800-61 - Computer Security Incident Handling Guide

NIST SP 800-64 - Security Considerations in the System Development Life Cycle

NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment

NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information Systems

NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

NIST SP 800-160 - Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and Organizations

1. SCOPE

a. The labor categories, prices, terms and conditions stated under Special Item Number 132- 45 Highly Adaptive Cybersecurity Services (HACS) apply exclusively to Highly Adaptive Cybersecurity Services within the scope of this Information Technology Schedule.

b. Services under this SIN are limited to Highly Adaptive Cybersecurity Services only. Software and hardware products are under different Special Item Numbers on IT Schedule 70 (e.g. 132-32, 132-33, 132-8), and may be quoted along with services to provide a total solution.

c. This SIN provides ordering activities with access to Highly Adaptive Cybersecurity services only.

d. Highly Adaptive Cybersecurity Services provided under this SIN shall comply with all Cybersecurity certifications and industry standards as applicable pertaining to the type of services as specified by ordering agency.

e. SCOPE:

54151HACS Highly Adaptive Cybersecurity Services (HACS) - SUBJECT TO COOPERATIVE PURCHASING -includes proactive and reactive cybersecurity services that improve the customer’s enterprise-level security posture.

The scope of this category encompasses a wide range of fields that include, but are not limited to, Risk Management Framework (RMF) services, information assurance (IA), virus detection, network management, situational awareness and incident response, secure web hosting, and backup and security services.

The seven-step RMF includes preparation, information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring.. RMF activities may also include Information Security Continuous Monitoring Assessment (ISCMA) which evaluate organization-wide ISCM implementations, and also Federal Incident Response Evaluations (FIREs), which assess an organization’s incident management functions.

The scope of this category also includes Security Operations Center (SOC) services. The SOC scope includes services such as: 24x7x365 monitoring and analysis, traffic analysis, incident response and coordination, penetration testing, anti-virus management, intrusion detection and prevention, and information sharing.

HACS vendors are able to identify and protect a customer’s information resources, detect and respond to cybersecurity events or incidents, and recover capabilities or services impaired by any incidents that emerge.

Sub-Categories - (not all vendors have been placed within the following subcategories. To view a complete list of vendors, click on the SIN)

High Value Asset (HVA) Assessments include Risk and Vulnerability Assessment (RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA subcategory include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing. Security

Architecture Review (SAR) evaluates a subset of the agency’s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems.

SAR provides a holistic analysis of how an HVA’s individual security components integrate and operate, including how data is protected during operations. Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on, but is not limited to the following security areas: perimeter security, network security, endpoint security, application security, physical security, and data security.

Risk and Vulnerability Assessment (RVA) assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing.

Cyber Hunt activities respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunts start with the premise that threat actors known to target some organizations in a specific industry or with specific systems are likely to also target other organizations in the same industry or with the same systems.

Incident Response services help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.

Penetration Testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

f. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2. ORDER

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket Purchase Agreements, individual purchase orders, or task orders for ordering services under this contract.

Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

3. PERFORMANCE OF SERVICES

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity. All Contracts will be fully funded.

b. The Contractor agrees to render services during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of Highly Adaptive Cybersecurity Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts. All travel will be agreed upon with the client prior to the Contractor’s travel.

4. INSPECTION OF SERVICES

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND CONDITIONS– COMMERCIAL ITEMS (Jan 2017) & (ALTERNATE I-Jan 2017) for Time-and-Materials and Labor-Hour orders placed under this contract.

5. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (May 2014) Rights in Data – General, may apply.

The Contractor shall comply with contract clause (52.204-21) to the Federal Acquisition Regulation (FAR) for the basic safeguarding of contractor information systems that process, store, or transmit Federal data received by the contract in performance of the contract. This includes contract documents and all information generated in the performance of the contract.

6. RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to the ordering activity security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Highly Adaptive Cybersecurity Services.

7. INDEPENDENT CONTRACTOR

All Highly Adaptive Cybersecurity Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

8. ORGANIZATIONAL CONFLICTS OF INTEREST

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the

Contractor or its affiliates or (ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract.

Examples of situations, which may require restrictions, are provided at FAR 9.508.

9. INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for Highly Adaptive Cybersecurity Services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

10. RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

11. APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

12. DESCRIPTION OF HIGHLY ADAPTIVE CYBERSECURITY SERVICES AND PRICING

a. The Contractor shall provide a description of each type of Highly Adaptive Cybersecurity Service offered under Special Item Number 54151HACS for Highly Adaptive Cybersecurity Services and it should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

b. Pricing for all Highly Adaptive Cybersecurity Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates, minimum general experience and minimum education. The following is an example of the manner in which the description of a commercial job title should be presented (see SCP FSS 004)

13. Description of HACS Professional Services and Pricing

(a) The Contractor shall provide a description of each type of IT Service offered under Special Item Numbers 54151HACS Professional Services should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

(b) Pricing for all HACS Professional Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates, monthly rates, term rates, and/or fixed prices, minimum general experience and minimum education.

(c) The following is an example of the manner in which the description of a commercial job title should be presented:

EXAMPLE: Commercial Job Title – System Engineer

Minimum / General Experience: Three (3) years of technical experience with applies to systems analysis and design techniques for complex computer systems. Requires competence in all phases of systems analysis techniques, concepts and methods; also requires knowledge of available hardware, system software, input / output devices, structure and management practices.

Functional Responsibility: Guides users in formulating requirements, advises alternative approaches, conducts feasibility studies.

Minimum Education: Bachelor’s Degree in Computer Science

14. Labor Category Descriptions

When determining the qualifications of an individual to fill one of the positions offered, substitutions for the education and experience requirements may be made, as shown in Tables 2 and 3. The minimum education and experience will be met when the education equivalencies in Tables 2 and 3 are considered.

Additional education achievements in excess of requirements can be substituted for experience requirements:

Table 1. Education Substitutions for Experience

Education Substitutions for Experience

Required Education Actual Education

Obtained

Additional Years of Experience Credited the DAKOTA

Employee

MA / MS PhD / JD / MD 4

BA / BS PhD / JD / MD 6

BA / BS MA / MS 2

AA / Technical Institute / Military Training

MA / MS 4

AA / Technical Institute / Military Training

BA / BS 2

HS / GED BA / BS 4

Additional experience in excess of requirements can be substituted for educational

Table 2. Experience Substitutions for Education

Experience Substitutions for Education

Actual Education Required Education Additional Years of Experience

Required by DAKOTA

NONE HS / GED 2

HS / GED AA / Technical 2

Experience Substitutions for Education

Actual Education Required Education Additional Years of Experience

Required by DAKOTA

Institute

HS / GED BA / BS 4

HS / GED MA / MS 6

HS / GED PhD / JD / MD No Equivalency

AA / Technical Institute BA / BS 2

AA / Technical Institute MA / MS 4

AA / Technical Institute PhD / JD / MD No Equivalency

BA / BS MA / MS 2

BA / BS PhD / JD / MD 6

MA / MS PhD / JD / MD 4

Dakota labor category descriptions are presented in CLIN numeric order.

CLIN: 01

Labor Category: Cyber Security Consultant - III

Minimum Preferred

Education: BS / BA BS / BA

Required Experience: 8 years 10 years

Qualifications: Minimum/General Experience: This position requires a minimum of eight years of professional experience.

Functional Responsibility: Functional Responsibilities: Supports the identification and configuration of security requirements for complex information technology systems, networks, and web applications. Provide security design, review, and recommendations. Implement and configure solutions that meet security requirements for defense in depth and other security related fields.

Supports penetration testing, vulnerability assessments, ongoing authorization, and independent verification and validation efforts. Provide junior level support for activities including risk assessments, incident response, cyber hunts, and forensics

CLIN: 02

Labor Category: Cyber Security Consultant - II

Minimum Preferred

Education: BS / BA MS / MA

Required Experience: 5 years 7 years

Qualifications: Minimum/General Experience: This position requires a minimum of five years of professional experience

Functional Responsibility: Conduct automated and manual penetration tests of networks, applications, web applications, servers, endpoints, wireless, and mobile technologies.

Uses automated and manual toolsets to perform reconnaissance, enumeration, and open source intelligence information gathering activities.

Performs analysis on testing results to identify false positives and assign risk criticality to vulnerabilities. Develops penetration testing reports to include vulnerabilities, identification methods, and enterprise security posture.

Provides recommendations to improve the existing security measures in place. Supports vulnerability assessments, ongoing authorization, independent verification and validation, incident response, and forensic activities, as needed.

CLIN: 03

Labor Category: Cyber Security Consultant - I

Minimum Preferred

Education: BS / BA MS

Required Experience: 3 years 5 years

Qualifications: Minimum/General Experience: This position requires a minimum of three years of professional experience

Functional Responsibility: Supports the identification and configuration of security requirements for complex information technology systems, networks, and web applications.

Provide security design, review, and recommendations. Implement and configure solutions that meet security requirements for defense in depth and other security related fields. Supports penetration testing, vulnerability assessments, ongoing authorization, and independent verification and validation efforts. Provide junior level support for activities including risk assessments, incident response, cyber hunts, and forensics

CLIN: 04

Labor Category: Penetration Tester - II

Minimum Preferred

Education: BS / BA MS / MA

Required Experience: 6 years 8 years

Qualifications: Minimum/General Experience: This position requires a minimum of six years of professional experience.

Functional Responsibility: Conduct automated and manual penetration tests of networks, applications, web applications, servers, endpoints, wireless, and mobile technologies.

Uses automated and manual toolsets to perform reconnaissance, enumeration, and open source intelligence information gathering activities.

Performs analysis on testing results to identify false positives and assign risk criticality to vulnerabilities. Develops penetration testing reports to include vulnerabilities, identification methods, and enterprise security posture.

Provides recommendations to improve the existing security measures in place. Supports vulnerability assessments, ongoing authorization, independent verification and validation, incident response, and forensic activities, as needed.

CLIN: 05

Labor Category: Penetration Tester - I

Minimum Preferred

Education: BS / BA BS

Required Experience: 2 years 4 years

Qualifications: Minimum/General Experience: This position requires a minimum of two years of professional experience.

Functional Responsibility: Conduct automated and manual penetration tests of networks, applications, web applications. Uses automated and manual toolsets to perform reconnaissance, enumeration, and open source intelligence information gathering activities. Develops penetration testing reports to include vulnerabilities, identification methods, and enterprise security posture.

Provides recommendations to improve the existing security measures in place. Supports vulnerability assessments and ongoing authorization, as needed.

CLIN: 06

Labor Category: Cyber Security Subject Matter Expert - III

Minimum Preferred

Education: BS / BA MS

Required Experience: 10 years 13 years

Qualifications: Minimum/General Experience: This position requires a minimum of ten years of professional experience

Functional Responsibility: Functional Responsibilities: Identify new issues and solutions in the field of cyber security to meet client requirements. Perform technical analysis with new or custom made tools and technologies to provide solutions in response to cyber security incidents and cyber hunt activities. Perform incident response and forensic activities in order to identify incident origins, remnant malware or other malicious code, and provide mitigation recommendations. Serve as senior level contact for project related reporting, issues, and status. Provide expertise in information security including: incident response, cyber hunt, and forensics, among others

CLIN: 07

Labor Category: Cyber Security Subject Matter Expert - II

Minimum Preferred

Education: BS / BA MS / MA

Required Experience: 7 years 10 years

Qualifications: Minimum/General Experience: This position requires a minimum of seven years of professional experience

Functional Responsibility: Identify new issues and solutions in the field of cyber security to meet client requirements. Perform technical analysis with new or custom made tools and technologies to provide solutions in response to cyber security incidents and cyber hunt activities. Perform incident response and forensic activities in order to identify incident origins, remnant malware or other malicious code, and provide mitigation recommendations. Provide expertise in information security including: penetration testing, cyber hunt, and vulnerability assessments, among others

CLIN: 08

Labor Category: Cyber Security Subject Matter Expert - I

Minimum Preferred

Education: BS / BA MS / MA

Required Experience: 3 years 6 years

Qualifications: Minimum/General Experience: This position requires a minimum of three years of professional experience

Functional Responsibility: Designs, develops, implements, and maintains complex databases with respect to the operating system, access methods, access time, device allocation, validation checks, organization, protection and security, documentation, guidelines, and statistical methods. Develops complex database designs, structured queries, reports, scripts, and other database code in support of automated systems development. Develops and maintains database dictionaries, entity relationships models, data models, monitors standards and procedures, and integrates system functionality through database design.

CLIN: 09

Labor Category: Senior Systems Engineer

Minimum Preferred

Education: BS / BA MS / MA

Required Experience: 5 years 7 years

Qualifications: Minimum/General Experience: This position requires a minimum of five years of directly related information technology experience.

Functional Responsibility: Works directly with management and senior staff for network related activities. Manages and monitors work of project teams and lower-level engineers. Provides direction for network architecture, designing, and troubleshooting of systems. Leads network mitigation, patching, and implementation of incident response efforts. Provides expertise in network and security software implementation and configuration. Ensures adherence with standards and industry best practices to assure compliance with project requirements.

CLIN: 10

Labor Category: Systems Engineer

Minimum Preferred

Education: BS / BA MS / MA

Required Experience: 2 years 5 years

Qualifications: Minimum/General Experience: This position requires a minimum of two years of directly related information technology experience.

Functional Responsibility: Provides support to senior staff for network related activities. Work as part of a project team. Performs information technology engineering analysis and design tasks as well as complex engineering analysis. Performs network mitigation, patching, and implementation of incident response efforts.

Provides support for network and security software implementation and configuration

CLIN: 11

Labor Category: Chief Architect

Minimum Preferred

Education: MS MS or PhD

Required Experience: 7 years 10 years

Qualifications: Minimum/General Experience: The position requires a minimum of ten years of experience providing security and software engineering and technical direction and leadership for personnel performing security task(s) and project

Functional Responsibility: Provides solutions to the most difficult information security problems in existing systems and systems development, and is responsible for overseeing and directing complex tasks.

CLIN: 12

Labor Category: Application Developer/Senior Software Developer

Minimum Preferred

Education: MA / MS PhD

Required Experience: 7 years 13 years

Qualifications: Minimum/General Experience: This position requires a minimum of seven years of experience in enterprise-wide application development in various programming languages.

Functional Responsibility: Provides a variety of complex project tasks that involve integration of electronic processes or methodologies to resolve total system problems, and application of analytical and systematic approaches in the resolution of problems of work flow, organization, and planning

CLIN: 13

Labor Category: Cyber Security Architect

Minimum Preferred

Education: MA / MS PhD

Required Experience: 10 years 15 years

Qualifications: This position requires a minimum of ten years of experience in security architecture planning, design, and implementation

Functional Responsibility: Designs, architects, maintains, configures and troubleshoots cyber security systems. Coordinates cyber security audits and communicates results.

Pursues necessary changes of critical tasks identified from audits. Develops, documents and communicates cyber security policies and procedures.

Services Pricelist

The labor categories and skill levels presented in Table 4 are predicated on our experience in the past three (3) years performing similar HACS professional services in support of multiple Federal clients.

Dakota is offering its labor rates with an escalation rate of 1.8% per year.

Table 4. HACS Services Pricelist

SIN Labor Category

Year 2 - Hourly

Rate w/IFF

Award -

8/14/2021

(Customer Site)

Year 2 - Hourly

Rate w/IFF

Award -

8/14/2021

(Contractor Site)

Year 3 - Hourly

Rate w/IFF

8/15/2021 -

8/14/2022

(Customer Site)

Year 3 - Hourly

Rate w/IFF

8/15/2021 -

8/14/2022

(Contractor Site)

Year 4- Hourly

Rate w/IFF

8/15/2022 -

8/14/2023

(Customer Site)

Year 4 - Hourly

Rate w/IFF

8/15/2022 -

8/14/2023

(Contractor Site)

Year 5- Hourly

Rate w/IFF

8/15/2023 -

8/14/2024

(Customer Site)

Year 5- Hourly Rate w/IFF 8/15/2023 -

8/14/2024 (Contractor

Site)

54151HACS Cyber Security Consultant - III $ 112.64 $ 123.78 $ 112.89 $ 124.05 $ 114.92 $ 126.29 $ 116.99 $ 128.56

54151HACS Cyber Security Consultant - II $ 107.27 $ 117.88 $ 107.52 $ 118.15 $ 109.45 $ 120.28 $ 111.42 $ 122.44

54151HACS Cyber Security Consultant - I $ 99.87 $ 109.75 $ 100.10 $ 110.00 $ 101.90 $ 111.98 $ 103.73 $ 113.99

54151HACS Penetration Tester - II $ 139.83 $ 153.66 $ 140.15 $ 154.01 $ 142.67 $ 156.78 $ 145.24 $ 159.60

54151HACS Penetration Tester - I $ 114.68 $ 126.02 $ 114.93 $ 126.30 $ 117.00 $ 128.57 $ 119.11 $ 130.89

54151HACS

Cyber Security Subject Matter Expert -

III $ 133.17 $ 146.34 $ 133.47 $ 146.67 $ 135.87 $ 149.31 $ 138.31 $ 151.99

54151HACS

Cyber Security Subject Matter Expert -

II $ 125.77 $ 138.20 $ 126.05 $ 138.51 $ 128.32 $ 141.01 $ 130.63 $ 143.55

54151HACS Cyber Security Subject Matter Expert - I $ 114.68 $ 126.02 $ 114.93 $ 126.30 $ 117.00 $ 128.57 $ 119.11 $ 130.89

54151HACS Senior Systems Engineer $ 118.10 $ 129.78 $ 118.37 $ 130.08 $ 120.50 $ 132.42 $ 122.67 $ 134.80

54151HACS Systems Engineer $ 100.44 $ 110.37 $ 100.66 $ 110.62 $ 102.47 $ 112.61 $ 104.32 $ 114.64

54151HACS Chief Architect $ 136.86 $ 150.40 $ 137.17 $ 150.74 $ 139.64 $ 153.45 $ 142.15 $ 156.21

54151HACS

Application Developer/Senior Software

Developer $ 137.54 $ 151.14 $ 137.85 $ 151.48 $ 140.33 $ 154.21 $ 142.86 $ 156.99

54151HACS Cyber Security Architect $ 139.83 $ 153.66 $ 140.15 $ 154.01 $ 142.67 $ 156.78 $ 145.24 $ 159.60

TERMS AND CONDITIONS APPLICABLE TO INFORMATION TECHNOLOGY (IT)

PROFESSIONAL SERVICES (SPECIAL ITEM NUMBER 54151S)

1. Scope

(a) The prices, terms and conditions stated under Special Item Number 54151S Information Technology Professional Services apply exclusively to IT Professional Services within the scope of this Information Technology Schedule.

(b) The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2. Performance Incentives I-FSS-60 Performance Incentives (April 2000)

(a) Performance incentives may be agreed upon between the Contractor and the ordering activity on individual fixed price orders or Blanket Purchase Agreements under this contract.

(b) The ordering activity must establish a maximum performance incentive price for these services and/or total solutions on individual orders or Blanket Purchase Agreements.

(c) Incentives should be designed to relate results achieved by the contractor to specified targets. To the maximum extent practicable, ordering activities shall consider establishing incentives where performance is critical to the ordering activity’s mission and incentives are likely to motivate the contractor. Incentives shall be based on objectively measurable tasks.

3. Order

(a) Agencies may use written orders, EDI orders, blanket purchase agreements, individual purchase orders, or task orders for ordering services under this contract. Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

(b) All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

4. Performance of Services

(a) The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity.

(b) The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

(c) The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

(d) Any Contractor travel required in the performance of IT Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel.

Contractors cannot use GSA city pair contracts.

5. Stop-Work Order (FAR 52.242-15) (AUG 1989)

(a) The Contracting Officer may, at any time, by written order to the Contractor, require the Contractor to stop all, or any part, of the work called for by this contract for a period of 90 days after the order is delivered to the Contractor, and for any further period to which the parties may agree. The order shall be specifically identified as a stop-work order issued under this clause. Upon receipt of the order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the order during the period of work stoppage.

Within a period of 90 days after a stop-work is delivered to the Contractor, or within any extension of that period to which the parties shall have agreed, the Contracting Officer shall either—

(1) Cancel the stop-work order; or

(2) Terminate the work covered by the order as provided in the Default, or the Termination for Convenience of the Government, clause of this contract.

(b) If a stop-work order issued under this clause is canceled or the period of the order or any extension thereof expires, the Contractor shall resume work. The Contracting Officer shall make an equitable adjustment in the delivery schedule or contract price, or both, and the contract shall be modified, in writing, accordingly, if—

(1) The stop-work order results in an increase in the time required for, or in the Contractor's cost properly allocable to, the performance of any part of this contract; and

(2) The Contractor asserts its right to the adjustment within 30 days after the end of the period of work stoppage; provided that, if the Contracting Officer decides the facts justify the action, the Contracting Officer may receive and act upon the claim submitted at any time before final payment under this contract.

(c) If a stop-work order is not canceled and the work covered by the order is terminated for the convenience of the Government, the Contracting Officer shall allow reasonable costs resulting from the stop-work order in arriving at the termination settlement.

(d) If a stop-work order is not canceled and the work covered by the order is terminated for default, the Contracting Officer shall allow, by equitable adjustment or otherwise, reasonable costs resulting from the stop-work order.

6. Inspection of Services

In accordance with FAR 52.212-4 CONTRACT TERMS AND CONDITIONS--COMMERCIAL ITEMS (JAN 2017) (DEVIATION – FEB 2007) (DEVIATION – FEB 2018) for Firm-Fixed Price orders; or GSAR 552.212-4

CONTRACT TERMS AND CONDITIONS COMMERCIAL ITEMS (JAN 2017) (DEVIATION – FEB 2018)

(ALTERNATE I – JAN 2017) (DEVIATION – FEB 2007) for Time-and-Materials and Labor-Hour Contracts orders placed under this contract.

7. Responsibility of the Contractor

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (Dec 2007) Rights in Data – General, may apply.

8. Responsibilities of the Ordering Activity

Subject to security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite IT Professional Services.

9. Independent Contractor

All IT Professional Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

10. Organizational Conflicts of Interest

(a) Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or (ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

(b) To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

11. Invoices

The Contractor, upon completion of the work ordered, shall submit invoices for IT Professional services.

Progress payments may be authorized by the ordering activity on individual orders if appropriate.

Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

12. Payments

For firm-fixed price orders the ordering activity shall pay the Contractor, upon submission of proper invoices or vouchers, the prices stipulated in this contract for service rendered and accepted. Progress payments shall be made only when authorized by the order. For time-and-materials orders, the Payments under Time-and-Materials and Labor-Hour Contracts at FAR 52.212-4 (MAR 2009) (ALTERNATE I – OCT 2008) (DEVIATION I – FEB 2007) applies to time-and-materials orders placed under this contract. For labor-hour orders, the Payment under Time-and-Materials and Labor-Hour Contracts at FAR 52.212-4 (MAR 2009) (ALTERNATE I – OCT 2008) (DEVIATION I – FEB 2007) applies to labor-hour orders placed under this contract.