MAS - Advanced Threat Analysis Inc. - 47QTCA20D0014

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 1

GENERAL SERVICES ADMINISTRATION

Federal Supply Service

AUTHORIZED FEDERAL SUPPLY SCHEDULE PRICE LIST

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order are available through GSA Advantage!®, a menu-driven database system.

The INTERNET address to GSA Advantage!® is: GSAAdvantage.gov.

INFORMATION TECHNOLOLGY SCHEDULE PRICE LIST

GENERAL PURPOSE COMMERCIAL INFORMATION TECHNOLOGY

EQUIPMENT, SOFTWARE AND SERVICES

FSC Group 70

SPECIAL ITEM NUMBER 132 45 --- Highly Adaptive Cybersecurity Services (HACS) SPECIAL ITEM NUMBER 132-51 --- Information Technology (IT) Professional Services

FPDS Code D302IT Systems Development Services FPDS Code D307 Automated Information Systems Design and Integration Services FPDS Code D308 Programming Services FPDS Code D310IT Backup and Security Services FPDS Code D311IT Data Conversion Services FPDS Code D316IT Network Management Services FPDS Code D399 Other Information Technology Services, Not Elsewhere Classified

Contract Number - 47QTCA20D0014

For more information on ordering from Federal Supply Schedules click on the FSS Schedules button at fss.gsa.gov.

Contract period - October 17, 2019 through October 16, 2024

PHONE: 571-480-1280

FAX: 410-969-7509

Kristine.titzer@atacorporation.com www.atacorporation.com http://www.atacorporation.com/

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 2

CUSTOMER INFORMATION

1a. Table of Awarded Special item numbers

132-45, 132-51

1b. Identification of the lowest priced model number and lowest unit price:

SIN Labor Category Rate

132-45 IT Specialist $54.86

132-51 Security Specialist $73.73

1c. Hourly Rates

SIN Labor Category Year 1 Year 2 Year 3 Year 4 Year 5

132-51 Independent Consultant $124.58 $127.82 $131.14 $134.55 $138.05

132-45 IT Specialist Jr. $42.82 $43.93 $45.08 $46.25 $47.45

132-45 IT Specialist Mid $94.28 $96.73 $99.25 $101.83 $104.47

132-45 IT Subject Matter Expert (SME) Sr.

$116.35 $119.38 $122.48 $125.66 $128.93

132-45, 132-51

Project Manager Sr. $148.11 $151.96 $155.91 $159.97 $164.12

132-45 Security Analyst Mid $96.42 $98.93 $101.50 $104.14 $106.85

132-45, 132-51

Security Analyst Sr. $157.98 $162.09 $166.30 $170.63 $175.06

132-45 Security Architect Master $256.73 $263.40 $270.25 $277.28 $284.49

132-45 Security Specialist Mid $73.61 $75.52 $77.49 $79.50 $81.57

132-45, 132-51

Systems Engineer (Security) Master

$197.48 $202.61 $207.88 $213.29 $218.83

132-45, 132-51

Systems Engineer (Security) Junior

$78.99 $81.04 $83.15 $85.31 $87.53

2. MAXIMUM ORDER:

132-45 - $500,000 132-51 - $500,000

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 3

3. MINIMUM ORDER: $100.00

4. GEOGRAPHIC COVERAGE (delivery area): Domestic Delivery – 48 States, DC

5. POINT OF PRODUCTION: Same as Contractor’s address

6. DISCOUNT: Prices shown are NET prices; basic discounts have been deducted

7. QUANTITY DISCOUNTS:

a. Prompt Payment: None

b. Quantity: None

c. Dollar Volume: Additional 1% for single task orders over $500,000

d. Other Special Discounts (i.e. Government Education Discounts, etc.)

8. PROMPT PAYMENT TERMS: None - Net 30 days

9a. Government purchase cards are accepted at or below the micro-purchase threshold.

9b. Government purchase cards are not accepted above the micro-purchase threshold.

10. FOREIGN ITEMS: None

11a. TIME OF DELIVERY: The Contractor shall deliver to destination within the number of calendar days after receipt of order (ARO), as set forth below:

SPECIAL ITEM NUMBER DELIVERY TIME (Days ARO)

132-45 To Be Negotiated per Task Order 132-51 To Be Negotiated per Task Order

11b. EXPEDITED DELIVERY: may be available. Contact Contractor for more information.

11c. OVERNIGHT AND 2-DAY DELIVERY: may be available. Contact Contractor for more information.

11d. URGENT REQUIREMENTS: When the Federal Supply Schedule contract delivery period does not meet the bona fide urgent delivery requirements of an ordering activity, ordering activities are encouraged, if time permits, to contact the Contractor for the purpose of obtaining accelerated delivery. The Contractor shall reply to the inquiry within 3 workdays after

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 4 receipt. (Telephonic replies shall be confirmed by the Contractor in writing.) If the Contractor offers an accelerated delivery time acceptable to the ordering activity, any order(s) placed pursuant to the agreed upon accelerated delivery time frame shall be delivered within this shorter delivery time and in accordance with all other terms and conditions of the contract.

12. FOB POINT: Destination

13a. ORDERING ADDRESS:

Advanced Threat Analysis Inc.

8008 Bush Hill Court Severn, MD 21144

13b. ORDERING PROCEDURES: Contact Contractor in 13a. above

14. PAYMENT ADDRESS:

Advanced Threat Analysis Inc.

8008 Bush Hill Court Severn, MD 21144

15. WARRANTY PROVISION: Standard Commercial Warranty

16. Export packing charges, if applicable: None

17. Terms and conditions of Government purchase card acceptance (any thresholds above the micro- purchase level) : None

18. Terms and conditions of rental, maintenance, and repair: None

19. Terms and conditions of installation: None

20. Terms and conditions of repair parts indicating date of parts price lists and any discounts from list prices: None

20a. Terms and conditions for any other services: None

21. List of service and distribution points: None

22. List of participating dealers: None

23. Preventive maintenance: None

24a. Special attributes such as environmental attributes (e.g., recycled content, energy

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 5 efficiency, and/or reduced pollutants) : None

24b. If applicable, indicate that Section 508 compliance information is available on Electronic and Information Technology (EIT) supplies and services and show where full details can be found (www.atacorporation.com). The EIT standards can be found at: www.Section508.gov/.

25. Data Universal Number System (DUNS) number: 07-8704273

26. Notification regarding registration in Central Contractor Registration (CCR) data:

Contractor has an active registration.

http://www.section508.gov/

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 6

TERMS AND CONDITIONS APPLICABLE TO HIGHLY ADAPTIVE CYBERSECURITY SERVICES (HACS)

(SPECIAL ITEM NUMBER 132-45)

Vendor suitability for offering services through the HACS SIN must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

● Federal Acquisition Regulation (FAR) Part 52.204-21

● OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of Personally Identifiable Information (PII)

● OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program

● 2017 Report to the President on Federal IT Modernization

● The Cybersecurity National Action Plan (CNAP)

● NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology Systems

● NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security)

● NIST SP 800-30 - Guide for Conducting Risk Assessments

● NIST SP 800-35 - Guide to Information Technology Security Services

● NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations: A Systems Life Cycle Approach for Security and Privacy

● NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View

● NIST SP 800-44 - Guidelines on Securing Public Web Servers

● NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

● NIST SP 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations

● NIST SP 800-61 - Computer Security Incident Handling Guide

● NIST SP 800-64 - Security Considerations in the System Development Life Cycle

● NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

● NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

● NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment

● NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information Systems

● NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

● NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

● NIST SP 800-160 - Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

● NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and Organizations

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 7

1. Scope

a. The labor categories, prices, terms and conditions stated under Special Item Number 132- 45 Highly Adaptive Cybersecurity Services (HACS) apply exclusively to Highly Adaptive Cybersecurity Services within the scope of this Information Technology Schedule.

b. Services under this SIN are limited to Highly Adaptive Cybersecurity Services only.

Software and hardware products are under different Special Item Numbers on IT Schedule 70 (e.g. 132-32, 132-33, 132-8), and may be quoted along with services to provide a total solution.

c. This SIN provides ordering activities with access to Highly Adaptive Cybersecurity Services only.

d. Highly Adaptive Cybersecurity Services provided under this SIN shall comply with all Cybersecurity certifications and industry standards as applicable pertaining to the type of services as specified by ordering agency.

e. Scope:

132- 45 Highly Adaptive Cybersecurity Services (HACS) - SUBJECT TO COOPERATIVE PURCHASING - includes proactive and reactive cybersecurity services that improve the customer’s enterprise-level security posture.

The scope of this category encompasses a wide range of fields that include, but are not limited to, Risk Management Framework (RMF) services, information assurance (IA), virus detection, network management, situational awareness and incident response, secure web hosting, and backup and security services.

The seven-step RMF includes preparation, information security categorization; control selection, implementation, and assessment; system and common control authorizations;

and continuous monitoring. RMF activities may also include Information Security Continuous Monitoring Assessment (ISCMA) which evaluate organization wide ISCM implementations, and also Federal Incident Response Evaluations (FIREs), which assess an organization’s incident management functions.

The scope of this category also includes Security Operations Center (SOC) services. The SOC scope includes services such as: 24x7x365 monitoring and analysis, traffic analysis, incident response and coordination, penetration testing, anti-virus management, intrusion detection and prevention, and information sharing.

HACS vendors are able to identify and protect a customer’s information resources, detect and respond to cybersecurity events or incidents, and recover capabilities or services impaired by any incidents that emerge.

Sub-Categories - (not all vendors have been placed within the following subcategories. To view a complete list of vendors, click on the SIN)

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 8

• High Value Asset (HVA) Assessments include Risk and Vulnerability Assessment (RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub- category include Network

Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web

Application Assessment, Operating System Security Assessment (OSSA), Database

Assessment, and Penetration Testing. Security Architecture Review (SAR) evaluates a subset of the agency’s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems. SAR provides a holistic analysis of how an HVA’s individual security components integrate and operate, including how data is protected during operations. Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on but is not limited to the following security areas: perimeter security, network security, endpoint security, application security, physical security, and data security.

• Risk and Vulnerability Assessment (RVA) assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security

Assessment (OSSA), Database Assessment, and Penetration Testing.

• Cyber Hunt activities respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunts start with the premise that threat actors known to target some organizations in a specific industry or with specific systems are likely to also target other organizations in the same industry or with the same systems.

• Incident Response services help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.

• Penetration Testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

f. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 9

2. ORDER

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket Purchase Agreements, individual purchase orders, or task orders for ordering services under this contract. Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made, and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

3. PERFORMANCE OF SERVICES

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity. All Contracts will be fully funded.

b. The Contractor agrees to render services during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of Highly Adaptive Cybersecurity Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts. All travel will be agreed upon with the client prior to the Contractor’s travel.

4. INSPECTION OF SERVICES

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND CONDITIONS – COMMERCIAL ITEMS (Jan 2017) & (ALTERNATE I-Jan 2017) for Time-and- Materials and Labor-Hour orders placed under this contract.

5. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (May 2014) Rights in Data – General, may apply.

The Contractor shall comply with contract clause (52.204-21) to the Federal Acquisition Regulation (FAR) for the basic safeguarding of contractor information systems that process, Advanced Threat Analysis Inc. 47QTCA20D0014 Page 10 store, or transmit Federal data received by the contract in performance of the contract. This includes contract documents and all information generated in the performance of the contract.

6. RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to the ordering activity security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Highly Adaptive Cybersecurity Services.

7. INDEPENDENT CONTRACTOR

All Highly Adaptive Cybersecurity Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

8. ORGANIZATIONAL CONFLICTS OF INTEREST

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or (ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

9. INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for Highly Adaptive Cybersecurity Services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 11 completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

10. RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

11. APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

12. DESCRIPTION OF HIGHLY ADAPTIVE CYBERSECURITY SERVICES AND PRICING

a. The Contractor shall provide a description of each type of Highly Adaptive Cybersecurity Service offered under Special Item Number 132-45 for Highly Adaptive Cybersecurity Services and it should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

b. Pricing for all Highly Adaptive Cybersecurity Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates, minimum general experience and minimum education.

The following is an example of the manner in which the description of a commercial job title should be presented (see SCP FSS 004.)

EXAMPLE

Computer Network Defense Analysis

Description: Uses defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or might occur within the network in order to protect information, information systems, and networks from threats.

Professionals involved in this specialty perform the following tasks:

• Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities

• Provide daily summary reports of network events and activity relevant to Computer Network Defense practices

• Monitor external data sources (e.g., Computer Network Defense vendor sites, Computer Emergency Response Teams, SANS, Security Focus) to maintain currency

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 12 of Computer Network Defense threat condition and determine which security issues may have an impact on the enterprise

Knowledge, Skills and Abilities: Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws, etc.), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/ criminal legal guidelines and procedures relevant to work performed.

Minimum Experience: 5 Years

Minimum Education Requirements: a bachelor's of science degree with a concentration in computer science, cybersecurity services, management information systems (MIS), engineering or information science is essential.

Highly Desirable: Offensive Security Certified Professional (OSCP) or commercial Cybersecurity advanced certification(s).

# Category SIN Education Level Experience

1 IT Specialist 132-45 Assoc Junior 1 Year

2 IT Specialist 132-45 Bachelor Mid 3 Years

3 IT Subject Matter Expert (SME) 132-45 Masters Senior 5 Years

4 Project Manager 132-45 Bachelor Senior 5 Years

5 Security Analyst 132-45 Bachelor Mid 3 Years

6 Security Analyst 132-45 Masters Senior 5 Years

7 Security Architect 132-45 Masters Master 10 Years

8 Security Specialist 132-45 Bachelor Mid 3 Years

9 Systems Engineer (Security) 132-45 Masters Master 10 Years

10 Systems Engineer (Security) 132-45 Assoc Junior 1 Year

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 13

LABOR CATEGORY DESCRIPTIONS

1) IT Specialist Jr.

Applies technical expertise to the implementation, monitoring, or maintenance of IT systems, focusing on network, database, systems administration and/or security functions. Specialty areas can include network analysis, system administration, security and information assurance, IT audit, and database administration. Prepares documentation/presentations in accordance with applicable technical/security guidance and customer policies/procedures. Assists with training needed in support of security, applications and/or the environment. Has knowledge of appropriate tools and techniques to perform required tasks.

Education: Associates Experience: 1 year

2) IT Specialist Mid.

Applies technical expertise to the implementation, monitoring, or maintenance of IT systems, focusing on network, database, systems administration and/or security functions. Specialty areas can include network analysis, system administration, security and information assurance, IT audit, and database administration. Prepares documentation/presentations in accordance with applicable technical/security guidance and customer policies/procedures. Assists with training needed in support of security, applications and/or the environment. Has knowledge of appropriate tools and techniques to perform required tasks.

Education: Bachelor’s Experience: 3 years

3) IT Subject Matter Expert (SME) Senior

Has expert technical knowledge in the areas of network analysis, system administration, security and information assurance, IT audit, advanced security testing, ethical hacking, database administration, and security guidance, such as NIST and FISMA. Leads teams or serves as subject matter expert for initial and annual security control assessments for systems. Leads teams in setting up program management support processes, to include schedules, tasks and metrics. Conducts risk and vulnerability assessments. Consults with customers on risk, vulnerability and security needs. Conducts security control assessments and audits and assists customers with responses. Conducts vulnerability scans to identify weaknesses and assist customers with remediation. Addresses changes to information systems and environments that may affect security controls. Has familiarity with the latest security tools and technologies and can advise customers on their specific technical aspects. Can research, recommend, configure, test and install security related software. Can schedule, plan, conduct and document penetration tests.

Education: Master’s Experience: 5 years

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 14

4) Project Manager Senior

Leads teams on IT and security-related projects and is responsible for outcomes from initiation through closeout. Manages the team, timeline, schedule, and execution of project to ensure that it meets goals and objectives. Analyzes new and complex project-related problems and works with team to develop innovative solutions. Can draft and brief customers on testing results and project-related topics/concepts. Interacts with and communicates effectively with customers verbally and in writing. Develops, maintains and briefs company, customers and team members on project progress, risks, issues and finances.

Education: Bachelor’s Experience: 5 years

5) Security Analyst Mid.

Assists customers in the areas of security risk management, to include security control assessment, continuous monitoring and compliance, FISMA reporting, ISSO support services, vulnerability assessment and management, security change management, and advanced security testing. Provides input on information systems in terms of their intended outcomes and ability to meet functional and security requirements. Is familiar with NIST and applicable security guidance. Can evaluate systems and security solutions in accordance with that guidance. Can support advanced security testing, such as penetration and infrastructure tests.

Drafts/updates security and risk related documentation, to include training materials. Has excellent verbal and written communications skills. Works effectively individually and as part of a team.

Education: Bachelor’s Experience: 3 years

6) Security Analyst Sr.

Assists customers in the areas of security risk management, to include security control assessment, continuous monitoring and compliance, FISMA reporting, ISSO support services, vulnerability assessment and management, security change management, and advanced security testing. Provides input on information systems in terms of their intended outcomes and ability to meet functional and security requirements. Is familiar with NIST and applicable security guidance. Can evaluate systems and security solutions in accordance with that guidance. Can support advanced security testing, such as penetration and infrastructure tests.

Drafts/updates security and risk related documentation, to include training materials. Has excellent verbal and written communications skills. Works effectively individually and as part of a team.

Education: Master’s Experience: 5 years

7) Security Architect Master

Works with developers, contractors and customers to design, develop and implement systems and related cyber security concepts, best practices, and procedures to ensure products meet

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 15 security requirements. Provides expertise in defining requirements and designing architectural specifications to ensure feasibility, functionality, and integration with connecting systems/platforms. Contributes as a senior level cyber specialist on complex projects providing customers with full cyber security and risk assessment support. Participates in risk management processes, including the use of tools to detect, remediate and mitigate security weaknesses. Manages comprehensive documentation packages for customer compliance with security requirements and assessments, including identifying gaps in policies and procedures and developing an action plan for full compliance.

Education: Master’s Experience: 10 years

8) Security Specialist Mid

Provides security engineering, planning support and technical expertise to ensure a secure enterprise that includes internal systems, cloud services and external/third-party service provider systems. Understands information assurance requirements and can document and communicate them to customers. Assists with studies and research related to FISMA, NIST guidance and updates, and corporate polices and supporting documentation.

Maintains/updates security assessment and authorizations; conducts annual reviews and updates of existing policies, procedures, certification documents, information architecture, and system administration security practices. Can provide recommendations for and assist with cost analysis for risk mitigation. Provides input from the security prospective for the enterprise and application architectures whenever changes are proposed, or problems are found. Reviews and provides feedback on SDLC documents and training. Evaluates current and potential customer security products.

Education: Bachelor’s Experience: 3 years

9) Systems Engineer (Security) Master

Analyzes and defines requirements for computer systems, which may include mainframes, servers, and personal computers. Helps design, develop, engineer, and implement solutions that meet business, functional and security requirements. Provides integration and implementation support. Assists customers with vulnerability/risk analyses/advanced security testing of computer systems and applications during all phases of the system development lifecycle. Supports team in advanced testing, to include penetration and infrastructure testing.

Analyzes general technical problems and provides basic engineering and technical support to solve those problems. Applies knowledge of network and system engineering, design and security concepts, practices, and procedures to ensure the effective integration and operation of information systems.

Education: Master’s Experience: 10 years

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 16

10) Systems Engineer (Security) Junior

Analyzes and defines requirements for computer systems, which may include mainframes, servers, and personal computers. Helps design, develop, engineer, and implement solutions that meet business, functional and security requirements. Provides integration and implementation support. Assists customers with vulnerability/risk analyses/advanced security testing of computer systems and applications during all phases of the system development lifecycle. Supports team in advanced testing, to include penetration and infrastructure testing.

Analyzes general technical problems and provides basic engineering and technical support to solve those problems. Applies knowledge of network and system engineering, design and security concepts, practices, and procedures to ensure the effective integration and operation of information systems.

For all labor categories, experience and education may be substituted for on another towards the satisfaction of labor category requirements. An overview of the substitution is included below:

Degree Required Years of Experience Credited

A.A 2

B.A. / B.S. 4

M.A. / M.S. 6

Ph.D / J.D. / M.D. 8

Additionally, attainment of professional certifications or licenses in the field of performance may be substituted for one (1) year of professional experience or as one (1) year of educational credit (i.e., two

(2) certifications equate to and A.A., four (4) certifications to a B.A, etc.).

TERMS AND CONDITIONS APPLICABLE TO INFORMATION TECHNOLOGY (IT) PROFESSIONAL

SERVICES (SPECIAL ITEM NUMBER 132-51)

**NOTE: All non-professional labor categories must be incidental to, and used solely to support professional services, and cannot be purchased separately.

1. SCOPE

a. The prices, terms and conditions stated under Special Item Number 132-51 Information Technology Professional Services apply exclusively to IT Professional Services within the scope of this Information Technology Schedule.

b. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2. PERFORMANCE INCENTIVES I-FSS-60 Performance Incentives (April 2000)

a. Performance incentives may be agreed upon between the Contractor and the ordering activity on individual fixed price orders or Blanket Purchase Agreements under this contract.

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 17

b. The ordering activity must establish a maximum performance incentive price for these services and/or total solutions on individual orders or Blanket Purchase Agreements.

c. Incentives should be designed to relate results achieved by the contractor to specified targets. To the maximum extent practicable, ordering activities shall consider establishing incentives where performance is critical to the ordering activity’s mission and incentives are likely to motivate the contractor. Incentives shall be based on objectively measurable tasks.

3. ORDER

a. Agencies may use written orders, EDI orders, blanket purchase agreements, individual purchase orders, or task orders for ordering services under this contract. Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made, and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

4. PERFORMANCE OF SERVICES

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity.

b. The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of IT Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts.

5. STOP-WORK ORDER (FAR 52.242-15) (AUG 1989)

a. The Contracting Officer may, at any time, by written order to the Contractor, require the Contractor to stop all, or any part, of the work called for by this contract for a period of 90 days after the order is delivered to the Contractor, and for any further period to which the parties may agree. The order shall be specifically identified as a stop-work order issued under this clause. Upon receipt of the order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the order during the period of work stoppage. Within a period of 90 days after a stop-work is delivered to the Contractor, or within any extension

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 18 of that period to which the parties shall have agreed, the Contracting Officer shall either:

(1) Cancel the stop-work order; or

(2)Terminate the work covered by the order as provided in the Default, or the Termination for Convenience of the Government, clause of this contract.

b. If a stop-work order issued under this clause is canceled or the period of the order or any extension thereof expires, the Contractor shall resume work. The Contracting Officer shall make an equitable adjustment in the delivery schedule or contract price, or both, and the contract shall be modified, in writing, accordingly, if:

(1)The stop-work order results in an increase in the time required for, or in the Contractor's cost properly allocable to, the performance of any part of this contract;

and

(2)The Contractor asserts its right to the adjustment within 30 days after the end of the period of work stoppage; provided, that, if the Contracting Officer decides the facts justify the action, the Contracting Officer may receive and act upon the claim submitted at any time before final payment under this contract.

c. If a stop-work order is not canceled and the work covered by the order is terminated for the convenience of the Government, the Contracting Officer shall allow reasonable costs resulting from the stop-work order in arriving at the termination settlement.

d. If a stop-work order is not canceled and the work covered by the order is terminated for default, the Contracting Officer shall allow, by equitable adjustment or otherwise, reasonable costs resulting from the stop-work order.

6. INSPECTION OF SERVICES

In accordance with FAR 52.212-4 CONTRACT TERMS AND CONDITIONS--COMMERCIAL ITEMS (MAR 2009) (DEVIATION I - FEB 2007) for Firm-Fixed Price orders and FAR 52.212-4

CONTRACT TERMS AND CONDITIONS - COMMERCIAL ITEMS (MAR 2009) (ALTERNATE I - OCT

2008) (DEVIATION I – FEB 2007) applies to Time-and-Materials and Labor-Hour Contracts orders placed under this contract.

7. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (Dec 2007) Rights in Data – General, may apply.

8. RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite IT Professional Services.

9. INDEPENDENT CONTRACTOR

All IT Professional Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 19

10. ORGANIZATIONAL CONFLICTS OF INTEREST

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refer to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or (ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

11. INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for IT Professional services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products.

Invoices shall be submitted monthly for recurring services performed during the preceding month.

12. PAYMENTS

For firm-fixed price orders the ordering activity shall pay the Contractor, upon submission of proper invoices or vouchers, the prices stipulated in this contract for service rendered and accepted. Progress payments shall be made only when authorized by the order. For time-and-materials orders, the Payments under Time-and-Materials and Labor-Hour Contracts at FAR 52.212-4 (MAR 2009) (ALTERNATE I – OCT 2008) (DEVIATION I – FEB 2007) applies to time-and-materials orders placed under this contract. For labor-hour orders, the Payment under Time-and-Materials and Labor-Hour Contracts at FAR 52.212-4 (MAR 2009) (ALTERNATE I – OCT 2008) (DEVIATION I – FEB 2007) applies to labor-hour orders placed

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 20 under this contract. 52.216-31(Feb 2007) Time-and-Materials/Labor-Hour Proposal Requirements—Commercial Item Acquisition As prescribed in 16.601(e)(3), insert the following provision:

a. The Government contemplates award of a Time-and-Materials or Labor-Hour type of contract resulting from this solicitation.

b. The offeror must specify fixed hourly rates in its offer that include wages, overhead, general and administrative expenses, and profit. The offeror must specify whether the fixed hourly rate for each labor category applies to labor performed by:

(1)The offeror;

(2)Subcontractors; and/or

(3)Divisions, subsidiaries, or affiliates of the offeror under a common control.

13. RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

14. INCIDENTAL SUPPORT COSTS

Incidental support costs are available outside the scope of this contract. The costs will be negotiated separately with the ordering activity in accordance with the guidelines set forth in the FAR.

15. APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity's Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

16. DESCRIPTION OF IT PROFESSIONAL SERVICES AND PRICING

a. The Contractor shall provide a description of each type of IT Service offered under Special Item Numbers 132-51 IT Professional Services. IT Professional Services should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

b. Pricing for all IT Professional Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates, monthly rates, term rates, and/or fixed prices, minimum general experience and minimum education.

1 Independent Consultant 132-51 Bachelors Senior 5 Years

2 Project Manager 132-51 Bachelors Senior 5 Years

3 Security Analyst 132-51 Masters Senior 5 Years

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 21

4 Systems Engineer (Security) 132-51 Masters Master 10 Years

5 Systems Engineer (Security) 132-51 Associates Junior 1 Year

1) Independent Consultant Senior

Has expert technical knowledge in the areas of networks, systems, security and information assurance, IT audit, advanced security testing, database administration, SDLC, and/or operations and maintenance. Leads teams or serves as subject matter expert. Can work independently, as part of a group or manage a team. Supports customers in the areas of systems, network and security requirements, design, configuration, testing, implementation, training and operations and maintenance. Can assist in the selection of COTS tools for system and enterprise levels and provide required support. Can develop, maintain and disseminate required metrics and respond to inquiries. Can perform system/application maintenance such as patching and updates. Regularly documents and reports project progress.

Education: Bachelor’s Experience: 5 years

2) Project Manager Senior

Leads teams on IT and security-related projects and is responsible for outcomes from initiation through closeout. Manages the team, timeline, schedule, and execution of project to ensure that it meets goals and objectives. Analyzes new and complex project-related problems and works with team to develop innovative solutions. Can draft and brief customers on testing results and project-related topics/concepts. Interacts with and communicates effectively with customers verbally and in writing. Develops, maintains and briefs company, customers and team members on project progress, risks, issues and finances.

Education: Bachelor’s Experience: 5 years

3) Security Analyst Sr.

Assists customers in the areas of security risk management, to include security control assessment, continuous monitoring and compliance, FISMA reporting, ISSO support services, vulnerability assessment and management, security change management, and advanced security testing. Provides input on information systems in terms of their intended outcomes and ability to meet functional and security requirements. Is familiar with NIST and applicable security guidance. Can evaluate systems and security solutions in accordance with that guidance. Can support advanced security testing, such as penetration and infrastructure tests.

Drafts/updates security and risk related documentation, to include training materials. Has excellent verbal and written communications skills. Works effectively individually and as part of a team.

Education: Master’s Experience: 5 years

Advanced Threat Analysis Inc. 47QTCA20D0014 Page 22

4) Systems Engineer (Security) Master

Analyzes and defines requirements for computer systems, which may include mainframes, servers, and personal computers. Helps design, develop, engineer, and implement solutions that meet business, functional and security requirements. Provides integration and implementation support. Assists customers with vulnerability/risk analyses/advanced security testing of computer systems and applications during all phases of the system development lifecycle.

Supports team in advanced testing, to include penetration and infrastructure testing. Analyzes general technical problems and provides basic engineering and technical support to solve those problems. Applies knowledge of network and system engineering, design and security concepts, practices, and procedures to ensure the effective integration and operation of information systems.

Education: Master’s Experience: 10 years

5) Systems Engineer (Security) Junior

Analyzes and defines requirements for computer systems, which may include mainframes, servers, and personal computers. Helps design, develop, engineer, and implement solutions that meet business, functional and security requirements. Provides integration and implementation support. Assists customers with vulnerability/risk analyses/advanced security testing of computer systems and applications during all phases of the system development lifecycle.

Supports team in advanced testing, to include penetration and infrastructure testing. Analyzes general technical problems and provides basic engineering and technical support to solve those problems. Applies knowledge of network and system engineering, design and security concepts, practices, and procedures to ensure the effective integration and operation of information systems.