MAS - Phia LLC - 47QTCA21D002K

1 | P a g e

AUTHORIZED FEDERAL SUPPLY SERVICE

MULTIPLE AWARD SCHEDULE

SPECIAL ITEM NUMBER:

54151HACS - HIGHLY ADAPTIVE CYBERSECURITY SERVICES (HACS)

541611 - Management and Financial Consulting, Acquisition and Grants Management Support, and Business Program and Project Management Services phia, LLC

Physical:

301 SW Tualatin Loop

West Linn, OR 97068-9734

Mailing:

11166 Fairfax Blvd. Ste. 500

PMB 1004

Fairfax, VA 22030

(P) 571-969-7442 (F) 703-563-9673 www.phiatech.com

Contract Number: 47QTCA21D002K Period Covered by Contract: 12/04/20 – 12/03/25 General Services Administration Federal Acquisition Service Pricelist current through Modification #0014, dated 12/13/2024.

Products and ordering information in this Authorized Multiple Award Schedule Pricelist are also available on the GSA Advantage! System (http://www.gsaadvantage.gov).

2 | P a g e

CUSTOMER INFORMATION:

1. Awarded Special Item Number(s):

SIN Description

54151HACS Highly Adaptive Cybersecurity Services (HACS)

541611 Professional Services

OLM Order Level Materials

1b. Identification of the lowest priced model number and lowest unit price for that model for each special item number awarded in the contract: See page 10.

1c. Descriptions of all corresponding commercial job titles with experience, functional responsibility and education are provided on pages 5-11 and 12-13.

2. Maximum Order: $500,000

3. Minimum Order: $100

4. Geographic Coverage: Worldwide

5. Point of Production: N/A

6. Prices Shown Herein are Net (discount deducted)

7. Quantity Discount: None

8. Prompt Payment Terms: Net 30

9. Government Purchase Cards: Will accept at, but not above the micro-purchase threshold.

10. Foreign Items: None

11. Time of Delivery: phia, LLC shall deliver or perform services in accordance with the terms negotiated in an agency’s order.

11b. Expedited Delivery: Consult with Contractor

11c. Overnight/2-Day Delivery: Consult with Contractor

11d. Urgent Requirements: Consult with Contractor

12. FOB Point: Destination

3 | P a g e

13. Ordering Address: GSA MAS - IT Schedule 70 ATTN: Business Development 11166 Fairfax Blvd. Ste. 500

PMB 1004

Fairfax, VA 22030

(P) 571-969-7442 (F) 703-563-9673 contracts@phiatech.com

14. Payment Address: Account Receivable ATTN: Truong D. Dang 11166 Fairfax Blvd. Ste. 500

PMB 1004

Fairfax, VA 22030

(P) 571-969-7442 Ext 701 (F) 703-563-9673 accounting@phiatech.com

15. Warranty Provisions: Contractor’s Standard Warranty

16. Export Packing charges: Not applicable

17. Terms and conditions of Government Purchase Card Acceptance: Please contact phia, LLC for terms and conditions of Government Purchase Card acceptance.

18. Terms and conditions of rental, maintenance, and repair: Not applicable

19. Terms and conditions of installation: Not applicable

20. Terms and conditions of repair parts: Not applicable

20a. Terms and conditions for any other services: Not applicable

21. List of service and distribution points: Not applicable

22. List of participating dealers: Not applicable

23. Preventive maintenance: Not applicable

24a. Environmental attributes, e.g., recycled content, energy efficiency, and/or reduced pollutants:

Not applicable

24b. phia, LLC for Section 508 compliance information. The EIT standards can be found at:

http://www.section508.gov. N/A

25. DUNS/UEI Number: 043643192/Z5AUUJCCF2Y5

26. phia, LLC is registered in the System for Award Management (SAM) database.

http://www.section508.gov/

4 | P a g e

GSA HOURLY RATES

SIN 54151HACS

Labor Category 12/04/20

12/03/21

12/04/21

12/03/22

12/04/22

12/03/23

12/04/23

12/03/24

12/04/24

12/03/25 HACS Cyber Security Analyst I $84.61 $86.72 $88.89 $91.11 $93.39 HACS Cyber Security Analyst II $98.18 $100.64 $103.15 $105.73 $108.38 HACS Cyber Security Analyst III $120.81 $123.83 $126.92 $130.10 $133.35 HACS Cyber Security Analyst IV $144.26 $147.87 $151.57 $155.36 $159.24 HACS Cyber Threat Analyst I $72.94 $74.76 $76.63 $78.55 $80.51 HACS Cyber Threat Analyst II $89.23 $91.46 $93.75 $96.09 $98.49 HACS Cyber Threat Analyst III $123.52 $126.61 $129.78 $133.02 $136.35 HACS Cyber Threat Intel Analyst II $104.99 $107.62 $110.31 $113.07 $115.89 HACS Cyber Threat Intel Analyst III $120.36 $123.37 $126.45 $129.61 $132.85 HACS DevOps Engineer I $101.68 $104.22 $106.83 $109.50 $112.24 HACS Digital Forensics Analyst $72.27 $74.08 $75.93 $77.83 $79.78 HACS Incident Response Analyst I $80.13 $82.13 $84.19 $86.29 $88.45 HACS Incident Response Analyst II $108.33 $111.04 $113.81 $116.66 $119.57 HACS Incident Response Analyst III $118.91 $121.88 $124.93 $128.05 $131.26 HACS Insider Threat Specialist $151.21 $154.99 $158.87 $162.84 $166.91 HACS Operations Analyst I $133.67 $137.01 $140.44 $143.95 $147.55 HACS Operations Analyst II N/A N/A N/A $170.35 $174.61 HACS Operations Analyst III N/A N/A N/A $186.04 $190.69 HACS Program Manager I $92.11 $94.42 $96.78 $99.20 $101.68 HACS Program Manager II $95.58 $97.97 $100.42 $102.93 $105.51 HACS Program Manager III $151.13 $154.91 $158.78 $162.75 $166.82 HACS Project Manager I $94.81 $97.18 $99.61 $102.10 $104.65 HACS Project Manager II $115.61 $118.50 $121.46 $124.50 $127.61 HACS Project Manager III $132.72 $136.04 $139.44 $142.93 $146.50 HACS Project Manager IV $161.26 $165.29 $169.42 $173.66 $178.00 HACS Security Architect I $110.91 $113.68 $116.52 $119.44 $122.42 HACS Security Architect II $157.35 $161.28 $165.32 $169.45 $173.69 HACS Security Architect III N/A N/A N/A $206.25 $211.41 HACS Security Engineer I $92.36 $94.67 $97.03 $99.46 $101.95 HACS Security Engineer II $104.67 $107.29 $109.97 $112.72 $115.54 HACS Security Engineer III $135.37 $138.75 $142.22 $145.78 $149.42

5 | P a g e

Labor Category Descriptions

HACS Cyber Security Analyst I Functional Responsibilities: The HACS Cyber Security Analyst I studies an organization's current computer systems and procedures, and designs information systems solutions to help the organization operate more securely, efficiently, and effectively. Brings business, Information Technology (IT), and Cybersecurity together by understanding the needs and limitations of both.

Minimum Education: Bachelor’s Minimum Experience: 1 year

HACS Cyber Security Analyst II Functional Responsibilities: The HACS Cyber Security Analyst II studies an organization's current computer systems and procedures, and designs information systems solutions to help the organization operate more securely, efficiently, and effectively. Brings business, IT, and Cybersecurity together by understanding the needs and limitations of both.

Minimum Education: Bachelor’s Minimum Experience: 5 years

HACS Cyber Security Analyst III Functional Responsibilities: The HACS Cyber Security Analyst III studies an organization's current computer systems and procedures, and designs information systems solutions to help the organization operate more securely, efficiently, and effectively. Brings business, IT, and Cybersecurity together by understanding the needs and limitations of both.

Minimum Education: Bachelor’s Minimum Experience: 10 years

HACS Cyber Security Analyst IV Functional Responsibilities: The HACS Cyber Security Analyst IV studies an organization's current computer systems and procedures, and designs information systems solutions to help the organization operate more securely, efficiently, and effectively. Brings business, IT, and Cybersecurity together by understanding the needs and limitations of both.

Minimum Education: Bachelor’s Minimum Experience: 15 years

HACS Cyber Threat Analyst I Functional Responsibilities: The HACS Cyber Threat Analyst I identifies and assesses the capabilities and activities of cybersecurity criminals or foreign intelligence entities. Produces findings to help initialize or support law enforcement and counterintelligence investigations or activities.

HACS Security Engineer IV $166.15 $170.30 $174.56 $178.92 $183.39

HACS SME I $160.68 $164.70 $168.82 $173.04 $177.36

HACS SME II $293.20 $300.53 $308.04 $315.74 $323.64

6 | P a g e

Minimum Education: Bachelor’s Minimum Experience: 1 year

HACS Cyber Threat Analyst II Functional Responsibilities: The HACS Cyber Threat Analyst II identifies and assesses the capabilities and activities of cybersecurity criminals or foreign intelligence entities. Produces findings to help initialize or support law enforcement and counterintelligence investigations or activities.

Minimum Education: Bachelor’s Minimum Experience: 5 years

HACS Cyber Threat Analyst III Functional Responsibilities: The HACS Cyber Threat Analyst III identifies and assesses the capabilities and activities of cybersecurity criminals or foreign intelligence entities. Produces findings to help initialize or support law enforcement and counterintelligence investigations or activities.

Minimum Education: Bachelor’s Minimum Experience: 10 years

HACS Cyber Threat Intel Analyst II Functional Responsibilities: The HACS Cyber Threat Intel Analyst II conducts advanced analysis of collection and open-source data to ensure target continuity; to profile targets and their activities; and develop techniques to gain more target information. Determines how targets communicate, move, operate, and live based on knowledge of target technologies, digital networks, and the applications on them.

Minimum Education: Bachelor’s Minimum Experience: 5 years

HACS Cyber Threat Intel Analyst III Functional Responsibilities: The HACS Cyber Threat Intel Analyst III collects, processes, preserves, analyzes, and presents computer-related evidence in support of network vulnerability mitigation and/or criminal, fraud, counterintelligence, or law enforcement investigations.

Minimum Education: Bachelor’s Minimum Experience: 10 years

HACS DevOps Engineer I Functional Responsibilities: The HACS DevOps Engineer I applies coding and testing standards, security testing tools (including ‘fuzzing’ static-analysis code scanning tools), threat modeling, and conducts code reviews. Conducts trial runs of programs and software applications to ensure the desired information is produced and instructions are correct. Evaluates factors such as reporting formats required, cost constraints, and need for security restrictions to determine hardware configuration. Performs integrated Quality Assurance (QA) testing for security functionality and resiliency attacks. Performs secure programming and identify potential flaws in codes to mitigate vulnerabilities. Applies comprehensive

7 | P a g e knowledge of Information Security issues to include; but not limited to, cloud technology, internet servers, web-enabled database applications, network security, security engineering, data integrity, intrusion detection, firewall management, forensic and legal information security, virtual private networks, Public Key Infrastructure (PKI) / digital signatures, encryption, network security architecture, and government Policy.

Minimum Education: Bachelor’s Minimum Experience: 1 year

HACS Digital Forensics Analyst Functional Responsibilities: The HACS Digital Forensics Analyst responds to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Uses mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Investigates and analyzes all relevant response activities.

Minimum Education: Bachelor’s Minimum Experience: 3 years

HACS Incident Response Analyst I Functional Responsibilities: The HACS Incident Response Analyst I responds to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Uses mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Investigates and analyzes all relevant response activities.

Minimum Education: Bachelor’s Minimum Experience: 1 year

HACS Incident Response Analyst II Functional Responsibilities: The HACS Incident Response Analyst II responds to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Uses mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Investigates and analyzes all relevant response activities.

Minimum Education: Bachelor’s Minimum Experience: 5 years

HACS Incident Response Analyst III Functional Responsibilities: The HACS Incident Response Analyst III responds to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Uses mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Investigates and analyzes all relevant response activities.

Minimum Experience: 10 years

8 | P a g e

HACS Insider Threat Specialist Functional Responsibilities: The HACS Insider Threat Specialist is involved in capturing, documenting, and correlating cyber incidents, events, and Requests For Information (RFIs) on a Cyber Security Operations Center (CSOC) floor. They assist with staffing, triage, assigning, tracking, and documenting incidents and results. They develop operational Standard Operating Procedures (SOPs.)

Minimum Education: Bachelor’s Minimum Experience: 10 years

HACS Operations Analyst I Functional Responsibilities: The HACS Operations Analyst I applies knowledge of data, information, processes, organizational interactions, skills, and analytical expertise, as well as systems, networks, and information exchange capabilities to manage acquisition programs. Executes duties governing hardware, software, and information system acquisition programs and other program management policies.

Provides direct support for acquisitions that use IT (including National Security Systems), applying IT-related laws and policies, and provides IT-related guidance throughout the total acquisition life cycle.

Minimum Education: Bachelor’s Minimum Experience: 3 years

HACS Operations Analyst II Functional Responsibilities: The HACS Operations Analyst II applies knowledge of data, information, processes, organizational interactions, skills, and analytical expertise, as well as systems, networks, and information exchange capabilities to manage acquisition programs. Executes duties governing hardware, software, and information system acquisition programs and other program management policies.

Provides direct support for acquisitions that use IT (including National Security Systems), applying IT-related laws and policies, and provides IT-related guidance throughout the total acquisition life cycle.

Minimum Education: Bachelor’s Minimum Experience: 5 years

HACS Operations Analyst III Functional Responsibilities: The HACS Operations Analyst III applies knowledge of data, information, processes, organizational interactions, skills, and analytical expertise, as well as systems, networks, and information exchange capabilities to manage acquisition programs. Executes duties governing hardware, software, and information system acquisition programs and other program management policies.

Provides direct support for acquisitions that use IT (including National Security Systems), applying IT-related laws and policies, and provides IT-related guidance throughout the total acquisition life cycle.

Minimum Education: Bachelor’s Minimum Experience: 7 years

HACS Program Manager I Functional Responsibilities: The HACS Program Manager I manages Cybersecurity operations for complex, mission-critical, and strategic programs which may involve multiple projects and groups of personnel at multiple locations. Utilizes proven leadership skills to organize, direct, and deploy resources

9 | P a g e with broad technical, business, and industry expertise. Oversees program budget, schedules, and all aspect of financial management of the program. Effectively manages funds, personnel, production standards, and resources (equipment and facilities) and ensures quality and timely delivery of all contractual items.

Minimum Education: Bachelor’s Minimum Experience: 3 years

HACS Program Manager II Functional Responsibilities: The HACS Program Manager II manages Cybersecurity operations for complex, mission-critical, and strategic programs which may involve multiple projects and groups of personnel at multiple locations. Utilizes proven leadership skills to organize, direct, and deploy resources with broad technical, business, and industry expertise. Oversees program budget, schedules, and all aspect of financial management of the program. Effectively manages funds, personnel, production standards, and resources (equipment and facilities) and ensures quality and timely delivery of all contractual items.

Minimum Education: Bachelor’s Minimum Experience: 5 years

HACS Program Manager III Functional Responsibilities: The HACS Program Manager III manages Cybersecurity operations for complex, mission-critical, and strategic programs which may involve multiple projects and groups of personnel at multiple locations. Utilizes proven leadership skills to organize, direct, and deploy resources with broad technical, business, and industry expertise. Oversees program budget, schedules, and all aspect of financial management of the program. Effectively manages funds, personnel, production standards, and resources (equipment and facilities) and ensures quality and timely delivery of all contractual items.

Minimum Education: Bachelor’s Minimum Experience: 15 years

HACS Project Manager I Functional Responsibilities: The HACS Project Manager (PM) I applies knowledge of data, information, processes, organizational interactions, skills, and analytical expertise, as well as systems, networks, and information exchange capabilities to manage acquisition programs. Executes duties governing hardware, software, and information system acquisition programs and other program management policies.

Provides direct support for acquisitions that use IT (including National Security Systems), applying IT-related laws and policies, and provides IT-related guidance throughout the total acquisition life cycle.

Minimum Education: Bachelor’s Minimum Experience: 3 years

HACS Project Manager II Functional Responsibilities: The HACS PM II applies knowledge of data, information, processes, organizational interactions, skills, and analytical expertise, as well as systems, networks, and information exchange capabilities to manage acquisition programs. Executes duties governing hardware, software, and information system acquisition programs and other program management policies. Provides direct

10 | P a g e support for acquisitions that use IT (including National Security Systems), applying IT-related laws and policies, and provides IT-related guidance throughout the total acquisition life cycle.

Minimum Education: Bachelor’s Minimum Experience: 5 years

HACS Project Manager III Functional Responsibilities: The HACS PM III applies knowledge of data, information, processes, organizational interactions, skills, and analytical expertise, as well as systems, networks, and information exchange capabilities to manage acquisition programs. Executes duties governing hardware, software, and information system acquisition programs and other program management policies. Provides direct support for acquisitions that use IT (including National Security Systems), applying IT-related laws and policies, and provides IT-related guidance throughout the total acquisition life cycle.

Minimum Education: Bachelor’s Minimum Experience: 10 years

HACS Project Manager IV Functional Responsibilities: The HACS PM IV set ups and maintains systems to be resilient to attacks.

They can Harden a system. Sometimes their area of focus is specific to certain hardware or sensors (such as Firewall Engineers).

Minimum Education: Bachelor’s Minimum Experience: 15 years

HACS Security Architect I Functional Responsibilities: The HACS Security Architect – I establishes system Security requirements using analysis of the security engineer(s) in the development of enterprise-wide or large-scale information systems. Determines and identifies high level security functional and technical requirements based on interactions with the user community and knowledge of the enterprise architecture. Designs security architecture to include the software, hardware, and communications to support the total requirements as well as provide for present and future cross-functional requirements and interfaces.

Minimum Education: Bachelor’s Minimum Experience: 1 year

HACS Security Architect II Functional Responsibilities: The HACS Security Architect – II establishes system Security requirements using analysis of the security engineer(s) in the development of enterprise-wide or large-scale information systems. Determines and identifies high level security functional and technical requirements based on interactions with the user community and knowledge of the enterprise architecture. Designs security architecture to include the software, hardware, and communications to support the total requirements as well as provide for present and future cross-functional requirements and interfaces.

Minimum Experience: 3 years

11 | P a g e

HACS Security Architect III Functional Responsibilities: The HACS Security Architect – III establishes system Security requirements using analysis of the security engineer(s) in the development of enterprise-wide or large-scale information systems. Determines and identifies high level security functional and technical requirements based on interactions with the user community and knowledge of the enterprise architecture. Designs security architecture to include the software, hardware, and communications to support the total requirements as well as provide for present and future cross-functional requirements and interfaces.

Minimum Education: Bachelor’s Minimum Experience: 7 years

HACS Security Engineer I Functional Responsibilities: The HACS Security Engineer – I ensures that the stakeholder security requirements necessary to protect the organization’s mission and business processes are adequately addressed in all aspects of enterprise architecture including reference models, segment and solution architectures, and the resulting systems supporting those missions and business processes.

Minimum Education: Bachelor’s Minimum Experience: 3 years

HACS Security Engineer II Functional Responsibilities: The HACS Security Engineer – II set ups and maintains systems to be resilient to attacks. They can Harden a system. Sometimes their area of focus is specific to certain hardware or sensors (such as Firewall Engineers).

Minimum Education: Bachelor’s Minimum Experience: 5 years

HACS Security Engineer III Functional Responsibilities: The HACS Security Engineer III set ups and maintains systems to be resilient to attacks. They can Harden a system. Sometimes their area of focus is specific to certain hardware or sensors (such as Firewall Engineers).

Minimum Education: Bachelor’s Minimum Experience: 10 years

HACS Security Engineer IV Functional Responsibilities: The HACS Security Engineer – IV set ups and maintains systems to be resilient to attacks. They can Harden a system. Sometimes their area of focus is specific to certain hardware or sensors (such as Firewall Engineers).

Minimum Education: Bachelor’s Minimum Experience: 15 years

HACS SME I

Functional Responsibilities: The HACS SME I utilizes Cybersecurity subject matter area expertise gained through direct industry experience to provide technical, managerial, and administrative direction for problem definition, analysis, requirements development, and implementation for complex to extremely

12 | P a g e complex systems in the subject matter area. Participates in strategy sessions, strategic assessments, and design reviews to validate enterprise approach and associated work products. Provides guidance and direction to other professionals, acts in a consulting and/or advisory capacity, and coordinates resolution of highly complex problems and tasks.

Minimum Education: Bachelor’s Minimum Experience: 5 years

HACS SME II

Functional Responsibilities: The HACS SME II utilizes Cybersecurity subject matter area expertise gained through direct industry experience to provide technical, managerial, and administrative direction for problem definition, analysis, requirements development, and implementation for complex to extremely complex systems in the subject matter area. Participates in strategy sessions, strategic assessments, and design reviews to validate enterprise approach and associated work products. Provides guidance and direction to other professionals, acts in a consulting and/or advisory capacity, and coordinates resolution of highly complex problems and tasks.

Minimum Education: Master’s Minimum Experience: 15 years

Experience & Degree Substitution Equivalencies Experience exceeding the minimum shown may be substituted for education. Likewise, education exceeding the minimum shown may be substituted for experience.

Equivalent Degree Experience High School 1 year of relevant experience Associate’s 2 years relevant experience Bachelor’s Associate’s degree + 2 years relevant experience or 4 years relevant experience Master’s Bachelor’s plus 2 years relevant experience or Associate’s degree + 4 years relevant experience or 6 years relevant experience PhD Master’s + 2 years relevant experience, or Bachelor’s + 4 years relevant experience or Associate’s + 6 years relevant experience or 8 years relevant experience

13 | P a g e

GSA HOURLY RATES

SIN 541611

Labor Category Descriptions

SIN 541611

Strategic Management Project Manager Functional Responsibilities: The Strategic Management Project Manager shall be responsible for overall contract management and the quality and timeliness of deliverables. The Project Manager shall monitor the status of the work accomplished, issues to be addressed with the Government and financial status of contract execution.

Minimum Education: Bachelor’s Minimum Experience: 7 years

Strategic Management Consultant Functional Responsibilities: The Strategic Management Consultant shall assist leadership with organizational data discovery, assessment of data for transformation and innovation followed by implementing selected changes or innovations. Ability to engage in strategic meetings with executive leadership across stakeholders. Experience in managing and implanting change or new enterprise complex programs within the Government. Possess institutional knowledge and ability to tap into a variety of resources to enable data collection, assessment of data and implementation of selected organization change initiatives on behalf of leadership.

Minimum Education: Bachelor’s Minimum Experience: 7 years

Strategic Management SME Functional Responsibilities: The Strategic Management SME is an expert and/or planner in their respective fields serving as representatives and imbedded within some of the critical areas to help with coordination, communication, and strategic alignment.

Labor Category 12/04/20

12/03/21

12/04/21

12/03/22

12/04/22

12/03/23

12/04/23

12/03/24

12/04/24

12/03/25 Strategic Management Project Manager N/A N/A N/A $206.25 $211.41 Strategic Management Consultant N/A N/A N/A $206.25 $211.41 Strategic Management SME N/A N/A N/A $208.66 $213.88 Strategic Management Analyst N/A N/A N/A $130.01 $133.26

14 | P a g e

Minimum Experience: 5 years

Strategic Management Analyst Functional Responsibilities: The Strategic Management Analyst providers support to senior staff and leadership which may include developing initial products, conducting analysis, supporting graphic design, working group meetings, embedding into relevant regions, divisions/sub-divisions and/or partnerships.

Minimum Experience: 3 years

Experience & Degree Substitution Equivalencies Experience exceeding the minimum shown may be substituted for education. Likewise, education exceeding the minimum shown may be substituted for experience.

Equivalent Degree Experience High School 1 year of relevant experience Associate’s 2 years relevant experience Bachelor’s Associate’s degree + 2 years relevant experience or 4 years relevant experience Master’s Bachelor’s plus 2 years relevant experience or Associate’s degree + 4 years relevant experience or 6 years relevant experience PhD Master’s + 2 years relevant experience, or Bachelor’s + 4 years relevant experience or Associate’s + 6 years relevant experience or 8 years relevant experience