MAS - Global Networks Inc. - 47QTCA20D0070

GENERAL SERVICES ADMINISTRATION

FEDERAL SUPPLY SERVICE

AUTHORIZED FEDERAL SUPPLY SCHEDULE PRICE LIST

MULTIPLE AWARD SCHEDULE

FSC GROUP MAS

The Contractor will be awarded under the cooperative purchasing program and disaster recovery for the awarded SIN: 54151HACS

Special Item Number 54151HACS: Highly Adaptive Cybersecurity Services (HACS) FSC Classes/Product Codes: FSC/PSC Class D310 IT And Telecom- Cyber Security and Data Backup

Contract Number: 47QTCA20D0070

Period Covered by Contract: March 6, 2020, through March 5, 2025

For more information on ordering from Federal Supply Schedules click on the FSS Schedules button at: http://fss.gsa.gov/.

Global Networks, Inc 6460 Dobbin Road, Suite A Columbia, MD 21045 Phone: 301-741-4315 https://www.gn-inc.com/ Contract Administrator: Alsylvia Pinkney E-Mail: apinkney@gn-inc.com

CONTRACTOR’S ADMINISTRATION SOURCE: Alsylvia Pinkney, President 6460 Dobbin Road, Suite A Columbia, MD 21045 301-741-4315 or 443-370-1829 apinkney@gn-inc.com

Business Size: SBA Certified Small Disadvantaged Business, Woman-Owned Small Business

CUSTOMER INFORMATION

1a. TABLE OF AWARDED SPECIAL ITEM NUMBERS WITH APPROPRIATE CROSS-REFERENCE TO ITEM DESCRIPTIONS AND AWARDED PRICES: Special Item Number 54151HACS

1b. LOWEST PRICED MODEL NUMBER AND PRICE FOR EACH SIN: See Approved GSA Pricing

1c. HOURLY RATES (Services only): Hourly rates, a description of all corresponding commercial job titles, experience, functional responsibility, and education for those types of employees or subcontractors can be found in subsequent pages below.

2. MAXIMUM ORDER: $500,000

NOTE TO ORDERING ACTIVITIES: *If the best value selection places your order over the Maximum Order identified in this catalog/pricelist, you have an opportunity to obtain a better schedule contract price. Before placing your order, contact the aforementioned contactor for a better price. The contractor may (1) offer a new price for this requirement (2) offer the lowest price available under this contract or (3) decline the order. A delivery order that exceeds the maximum order may be placed under the schedule contract in accordance with FAR 8.404.

3. MINIMUM ORDER: $100

4. GEOGRAPHIC COVERAGE: The Geographic Scope of Contract will be domestic delivery (50 States, DC, and US Territories).

5. POINT OF PRODUCTION: Same as contractor

6. DISCOUNT FROM LIST PRICES OR STATEMENT OF NET PRICE: Prices shown are NET Prices; Basic Discounts have been deducted.

7. QUANTITY DISCOUNTS: +1%, for task orders over $500,000

8. PROMPT PAYMENT TERMS: 0% - net 30 days from receipt of invoice or date of acceptance, whichever is later. Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions.

9. FOREIGN ITEMS: Not Applicable

12a. ORDERING ADDRESS: Same as contractor

12b. ORDERING PROCEDURES: Ordering activities shall use the ordering procedures described in Federal Acquisition Regulation 8.405-3 when placing an order or establishing a BPA for supplies or services. The ordering procedures, information on Blanket Purchase Agreements (BPA’s) and a sample BPA can be found at the GSA/FSS Schedule Homepage (fss.gsa.gov/schedules).

13. PAYMENT ADDRESS: Same as contractor

14. WARRANTY PROVISION: Not applicable

15. EXPORT PACKING CHARGES, IF APPLICABLE: Not Applicable

16. TERMS AND CONDITIONS OF RENTAL, MAINTENANCE, AND REPAIR: Not applicable.

17. TERMS AND CONDITIONS OF INSTALLATION: Not applicable.

18a. TERMS AND CONDITIONS OF REPAIR PARTS INDICATING DATE OF PARTS PRICE LISTS AND ANY DISCOUNTS FROM LIST PRICES (IF AVAILABLE): Not applicable.

18b. TERMS AND CONDITIONS FOR ANY OTHER SERVICES: Not applicable

19. LIST OF SERVICE AND DISTRIBUTION POINTS (IF APPLICABLE): Not applicable.

20. LIST OF PARTICIPATING DEALERS: Not applicable.

21. PREVENTIVE MAINTENANCE (IF APPLICABLE): Not applicable.

22a. SPECIAL ATTRIBUTES SUCH AS ENVIRONMENTAL ATTRIBUTES (E.G., recycled content, energy efficiency, and/or reduced pollutants): Not applicable.

22b. Section 508 compliance for electronic and information technology (eit): section 508 compliance information on the supplies and services in this contract are available at the following website address (url): http://www.gn-inc.com/

The EIT standard can be found at: www.Section508.gov/

23. UNIQUE ENTITY IDENTIFIER (UEI) NUMBER: JKBCXER3B148

24. NOTIFICATION REGARDING REGISTRATION IN SYTEM FOR AWARD MANAGEMENT (SAM) DATABASE: Contractor has an Active Registration in the SAM database.

IT Professional Highly Adaptive Cybersecurity Services

1. Only IT Professional Highly Adaptive Cybersecurity Services (HACS) shall be offered under this special item number. The following are the approved subcategories:

• High Value Asset (HVA) Assessments.

• Risk and Vulnerability Assessments (RVA),

• Cyber Hunt,

• Incident Response, and

• Penetration Testing

2. Resumes shall be provided to the GSA contracting officer or the ordering activity upon request.

3. Services offered SIN 54151HACS shall be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

· Federal Acquisition Regulation (FAR) Part 52.204-21

· OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of Personally Identifiable Information (PII)

· OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program

· 2017 Report to the President on Federal IT Modernization

· The Cybersecurity National Action Plan (CNAP)

· NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology Systems

· NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security)

· NIST SP 800-30 - Guide for Conducting Risk Assessments

· NIST SP 800-35 - Guide to Information Technology Security Services

· NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations: A Systems Life Cycle Approach for Security and Privacy

· NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View

· NIST SP 800-44 - Guidelines on Securing Public Web Servers

· NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

· NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

· NIST SP 800-61 - Computer Security Incident Handling Guide

· NIST SP 800-64 - Security Considerations in the System Development Life Cycle

· NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

· NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

· NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment

· NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information Systems

· NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

· NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

· NIST SP 800-160 - Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

· NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and Organizations.

4. The below is a list of IT Professional Service HACS/Labor Categories being offered:

Please see below for a list of services offered.

LABOR CATEGORY DESCRIPTIONS

Security Operations Specialist Experience: 5 years minimum Education Minimum: Bachelor’s Degree Certification: CISSP, CISM, or PMP Responsibilities: Conducts quality control in clients’ system management tools. Primary point of contact for the customer on project/program related details. Ensures quality and timeliness of client deliverables. Supports positive client/team relationships. Develops methodologies and provides recommendations for continuous improvements in Information Technology (IT), Penetration Testing, Incident Response, Cyber Hunt, and Risk and Vulnerability Assessment (RYA) Support Services in compliance with FISMA, DIACAP, DCID, NIST 800 SP, FIPS, ISO, and other statutory and client requirements. Meets with clients and staff to coordinate efforts, resolve conflicts, and provide guidance to meet project requirements. Evaluates proposed solutions to determine technical and functional feasibility and adequacy, and cost for implementation and operation. Provides in-depth knowledge and insight, technical experience, and subject-matter expertise (SME) to help solve complex problems. Ensures tasks are adequately planned and implemented. Manages contractors and subcontractors work policies, purposes, goals, standards, contractor schedules, discrepancies, and disputes.

Senior Engineer Experience: 3 years minimum Education Minimum: Bachelor’s Degree Certification: CISSP, CISM, CISA, or equivalent Responsibilities: Provides clients in-depth knowledge and insight, guidance, and support on management for internal and external systems related to information assurance, security engineering, telecommunications engineering, security control assessors, penetration testing, security training, network security, incident response, contingency planning, risk management, policy, guidelines, procedures, data loss prevention, change management tasks. Tracks task status, interfaces with clients, conducts analysis and evaluation of multiple systems, tasks and assignments using automated support tools. Monitors systems through the development life cycle. Conducts and monitors scanning, testing, interviews, and document development. Collaborates with clients to ensure compliance with FISMA, NIST SPs, 0MB Circular A130, ISO DIACAP, DCID standards, and other required policy, regulations, procedures, and guidelines. Conducts quality control checks of the client system assessment tool. Manages vulnerabilities from identification (assessment) to remediation (Plan of Action and Milestones (POA&M)) phase. Completes daily, weekly, monthly, quarterly, and annual reports and presentations to clients. Develops security training for client and tracks training. Monitors blacklist and whitelist to provide recommendations for COTS. Evaluates proposed automated solutions to determine technical and functional feasibility and adequacy, and cost for implementation and operation. Assists with system design, quality assurance, testing and customer training. Maintains records of security monitoring and incident response activities, utilizing case management and ticketing technologies. Monitors and analyzes Security Information and Event Management (SIEM) to identify security issues for remediation. Provides client recommendations based on thorough analysis of threat assessment, vulnerability analysis, risk assessment, information gathered, and evaluation of packets and logs.

Engineer Experience: 1 year minimum Education Minimum: Bachelor’s Degree Certification: Security+, CAP, or equivalent Responsibilities: Provides client support on internal and external systems in compliance with FISMA DIAQCAP, NIST 800 SPs, ISO, DCID and required governance. Monitors systems through the development life cycle. Performs analysis, assessments, tests, and evaluation of existing or proposed processes, applications, systems. Research, drafts, reviews, edits, and provides input to operating policy and procedures. Recommends and assists clients with remediation effort. Creates and submits data for client deliverables. Collaborates with system stakeholders on completion of system artifacts and POA&Ms. Plan of Action and Milestones (POAM), manage and track completion dates for POAM items, assemble remediation packages for POAM items and perform remediation of findings involving security program compliance. Conducts scanning, compliance cross-checking, continuous monitoring, penetrating testing, security control assessments, patching, mitigation, creates security authorization reports, conducts interviews, tests software, and generates the formal report to deliver to the client. Completes daily, weekly, and monthly reports and presentations to clients. Updates security training for client and tracks training. Manages and tracks access/ account control process including collecting, distributing, tracking, and storing access request forms, perform annual user revalidation documentation updates. Monitors blacklist and whitelist to provide recommendations for COTS. Evaluates proposed automated solutions to determine technical and functional feasibility and adequacy, and cost for implementation and operation. Assists with system design, quality assurance, testing and customer training. Maintains records of security monitoring and incident response activities, utilizing case management and ticketing technologies. Monitors and analyzes SIEM and updates report for submission to client. Provides client recommendations based on thorough analysis of threat assessment, vulnerability analysis, risk assessment, information gathered, and evaluation of packets and logs. Performs hunting activities and live response data collection and analysis to search the network for indicators of compromise and hosts during investigation. Helps determine the extent of the compromise, attributes of any malware and possible data exfiltrated.

Associate Engineer Experience: 1 year minimum Education: Associate Degree Certification: Not required Responsibilities: Provides client support on internal and external systems in compliance with FISMA DIAQCAP, NIST 800 SPs, ISO, DCID and required governance. Monitors systems through the development life cycle. Assists with the performance of analysis, assessments, tests, and evaluation of existing or proposed processes, applications, systems. Research, drafts, reviews, edits, and provides input to operating policy and procedures. Assists in providing client recommends and remediation effort. Collaborates with system stakeholders on completion of system artifacts, POA&M completion dates, assembly of remediation packages, and perform remediation of findings involving security program compliance. Conducts scanning, compliance cross-checking, continuous monitoring, penetrating testing, security control assessments, patching, mitigation, creates security authorization reports, conducts interviews, tests software, and generates the formal report to deliver to the client. Completes data for inclusion in the daily, weekly, and monthly reports and presentations to clients. Updates security training for clients and tracks training. Track access/account control process including collecting, distributing, tracking, and storing access request forms, perform annual user revalidation documentation updates. Monitors blacklist and whitelist to provide recommendations for COTS. Assists with system design, quality assurance, resting and customer training. Maintains records of security monitoring and incident response activities, utilizing case management and ticketing technologies. Monitors and analyzes SIEM and updates report for submission to client. Provides client recommendations based on thorough analysis of threat assessment, vulnerability analysis, risk assessment, information gathered, and evaluation of packets and logs. Performs hunting activities and live response data collection and analysis to search the network for indicators of compromise and hosts during investigation. Helps determine the extent of the compromise, attributes of any malware and possible data exfiltrated. Gathers, analyzes, edits, and prepares technical information for submission to the client. Conducts research and ensures the use of proper technical terminology and documentation standards. Translates technical information into readable documents. Assts in the preparation of presentation graphics and supports the development of contract deliverables and reports.

Engineer II Experience: 5 years minimum Education Minimum: Bachelor’s Degree Certification: None Responsibilities: Responsible for supporting hardware configurations, installing software, managing network systems, and training staff on correct operating procedures. Extensive experience maintaining large-scale computer systems. Must have excellent troubleshooting skills and have the capability to support senior engineering personnel in testing control apparatus using IT tools. May direct field operations and support in systems integrations.

Engineer III Experience: 7 years minimum Education Minimum: Bachelor’s Degree Certification: None Responsibilities: Works with clients to ensure that project goals are aligned. Supports quality assurance and troubleshooting during the lifecycle of the project. Responsible for designing hardware configurations, installing software, managing network systems, and training staff on correct operating procedures. Designs and integrates systems utilizing research and development. Must have extensive experience maintaining large-scale computer systems, have excellent troubleshooting skills and the capability to direct engineering personnel in testing control apparatus using IT tools. May direct field operations and support in systems integrations.

Engineer IV Experience: 15 years minimum Education Minimum: Bachelor’s Degree Certification: None Responsibilities: Manages the full lifecycle of projects, ensuring that they fall within budget and on schedule. Works with clients to ensure that project goals are aligned. Supports quality assurance and troubleshooting during the lifecycle of the project. Responsible for writing proposals, funding and approving project budgets and represent the organization while presenting at conferences about their specific work. Researches, develops, designs, and testing processes, products, and systems for commercial, industrial, medical, military, and scientific applications, applying principles and techniques of systems engineering: Designs electronic components and integrated systems, utilizing ferroelectric, nonlinear, dielectric, phosphorescent, photoconductive, and thermoelectric properties of materials, and directs engineering personnel in fabrication of test control apparatus and equipment. May direct field operations and maintenance of IT Systems.

Subject Matter Expert I Experience: 5 years minimum Education Minimum: Bachelor’s Degree Certification: None Responsibilities: Responsible for serving as facilitator for defining/ameliorating the policies and procedures of an organization, process, or program. Utilizes their specialization and subject matter knowhow to assist the business analysts and Project Managers in developing a secure environment and defining the security requirements and best practices. The Subject Matter Expert (SME) functions as the organizational ambassador for his knowledge area and applies his/her expertise to support an organization’s vision.

Subject Matter Expert II Experience: 10 years minimum Education Minimum: Bachelor’s Degree Certification: None Responsibilities: The SME II is responsible for leading a workstream of change management and communications experts to develop a change management strategy and communications plan. The SME assesses change readiness, leadership alignment, and organizational impact. Articulates a change vision and strategy and recommends training strategies. The SME conducts stakeholder analysis and communications to obtain awareness, understanding, buy-in, and support. Defines project workflows, manages resources, prioritizing responsibilities and tasks to deliver quality and timely results. Proactively engages with clients to identify challenges, recommend solutions, and manage expectations. Designs appropriate analysis for diagnostics and implementation, analyzing and interpreting ambiguous and complex information and relationships. Prepares final drafts of major deliverables ensuring quality control. Anticipates client needs, recognizes, and acts on opportunities to enhance client services and expand the scope of engagement.

Subject Matter Expert III Experience: 15 years minimum Education Minimum: Bachelor’s Degree Certification: None Responsibilities: The SME III is the definitive source responsible for managing and assessing compliance with the IS Policy to include the Disaster Recovery Policy for client organizations. Responsible for ensuring that the organization networks and information is always secure by constantly monitoring intrusion detection, data encryption, and taking quick and effective corrective measures in the event of a breach. Provides technical knowledge and analysis of information assurance including applications, operating systems, Internet and Intranet, physical security, networks, risk assessment, critical infrastructure continuity and contingency planning, emergency preparedness, security awareness and training. Provides analysis of existing system's vulnerabilities to possible intrusions, resource manipulation, resource denial and destruction of resources. Provides technical support and analysis to document organizational information protection framework and supports policy and procedures preparation and implementation. Monitors firewall logs. Analyzes the client system security, conducts gap analysis, determines enterprise information security standards, develops, and implements information security standards and procedures. Ensures that all information systems are functional and secure. knowledge, technique, or expertise in a specific subject area, such as business management, information technology, software development, process engineering. The SME functions as the organizational ambassador for his knowledge area, and he applies his expertise to support an organization’s vision.

Information Assurance Engineer Experience: 5 years minimum Education Minimum: Bachelor’s Degree Certification: None Responsibilities: The Information Assurance Engineer is responsible for assessing compliance with the IS Policy including the Disaster Recovery Policy for client organizations. Responsible for ensuring that the organization networks and information is always secure by constantly monitoring intrusion detection, data encryption, and taking quick and effective corrective measures in the event of a breach. Provides technical knowledge and analysis of information assurance, to include applications, operating systems, Internet and Intranet, physical security, networks, risk assessment, critical infrastructure continuity and contingency planning, emergency preparedness, security awareness and training. Provides analysis of existing system's vulnerabilities to possible intrusions, resource manipulation, resource denial and destruction of resources. Provides technical support and analysis to document organizational information protection framework and supports policy and procedures preparation as well as implementation. Monitors firewall logs. Analyzes the client system security, conducts gap analysis, determines enterprise information security standards, and develops and implements information security standards and procedures. Ensures that all information systems are functional and secure.

Project Manager Experience: 5 years minimum Education Minimum: Bachelor’s Degree Certification: None Responsibilities: The Project Manager has the primary responsibility to plan, track, and manage projects to which they are assigned to success. He/she will identify key stakeholders and help define the project scope, objectives, and expectations. The Project Manager manages projects according to the clients-approved project frameworks, including both Agile and traditional project management approaches. He/she must be able to take an active senior leadership role in the team and create an environment that fosters the prescribed agile methods and processes. Finally, the Project Manager must be able to identify issues proactively, resolve conflicts, escalate if necessary, and work across the organization to execute the project.

SUBSTITUTION CHART

Substitution Methodology: Due to the availability or limitation of education, occasionally substitution of experience as referenced above for a professional labor type with additional years of experience will be provided to the Federal Agency when responding to their IT requirements and it is solely the acquiring agency’s determination, if the substitution is considered acceptable prior to an award.

PRICE LIST

301-741-4315 47QTCA20D0070 Page 2 image2.emf image1.png image3.png