MAS - Anthony Timbers LLC - 47QTCA21D00BS

GENERAL SERVICES ADMINISTRATION

FEDERAL SUPPLY SERVICE

AUTHORIZED FEDERAL SUPPLY SCHEDULE CATALOG/PRICE LIST

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order is available through GSA Advantage!, a menu-driven database system.

The INTERNET address for GSA Advantage! is http://www.gsaadvantage.gov

SCHEDULE TITLE: Multiple Award Schedule

FSC Classes/Product Codes: DJ01

CONTRACT NUMBER: 47QTCA21D00BS

CONTRACT PERIOD: 06/30/2021 - 06/29/2031

For more information on ordering from Federal Supply Schedules click on the FSS Schedules button at:

http://fss.gsa.gov/.

CONTRACTOR: Anthony Timbers LLC 1320 Central Park Blvd, Suite 200 Fredericksburg, VA 22401 Phone number: 202-731-9376 Fax number:

E-Mail: a.timbers@anthonytimbers.com Website: https://anthonytimbers.com

CONTRACTOR’S ADMINISTRATION SOURCE: Anthony Timbers, CEO 1320 Central Park Blvd, Suite 200

Fredericksburg, VA 22401 Phone number: 202-731-9376 Fax number:

E-Mail: a.timbers@anthonytimbers.com

BUSINESS SIZE: Minority Owned Small Business http://www.gsaadvantage.gov/ http://fss.gsa.gov/

CUSTOMER INFORMATION:

1a. TABLE OF AWARDED SPECIAL ITEM NUMBERS (SINs)/NAICS

NAICS DESCRIPTION

54151HACS – Highly Adaptive Cybersecurity Services

1b. LOWEST PRICED MODEL NUMBER AND PRICE FOR EACH SIN:

(Government net price based on a unit of one)

Security Analyst I - $68.66/Hour

1c. HOURLY RATES (Services only): See Price List on Page 7

2. MAXIMUM ORDER*:

$500,000 per NAICS and $500,000 per order

NOTE TO ORDERING ACTIVITIES: *If the best value selection places your order over the Maximum Order identified in this catalog/pricelist, you have an opportunity to obtain a better schedule contract price. Before placing your order, contact the aforementioned contactor for a better price. The contractor may (1) offer a new price for this requirement (2) offer the lowest price available under this contract or (3) decline the order. A delivery order that exceeds the maximum order may be placed under the schedule contract in accordance with

FAR 8.404.

3. MINIMUM ORDER:

$1,000 per NAICS and $1,000 per order

4. GEOGRAPHIC COVERAGE: Domestic

5. POINT(S) OF PRODUCTION: Fredericksburg, VA

6. DISCOUNT FROM LIST PRICES: GSA Net Prices are shown on the attached GSA

Pricelist. Negotiated discount has been applied and the IFF has been added.

7. QUANTITY DISCOUNT(S): 2% discount on single orders over $250,000.

8. PROMPT PAYMENT TERMS: 2%, 10 Days; Net 30. Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions.

9. FOREIGN ITEMS: N/A

10a. TIME OF DELIVERY: 30 Days ARO or Specified at Task Order

10b. EXPEDITED DELIVERY: Items available for expedited delivery are noted in this price list or negotiated at the task order level.

10c. OVERNIGHT AND 2-DAY DELIVERY: Contact Contractor

10d. URGENT REQUIRMENTS: Agencies can contact the Contractor’s representative to affect a faster delivery. Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

11. FOB POINT: Destination

12a. ORDERING ADDRESS: Same as contractor

12b. ORDERING PROCEDURES: Ordering activities shall use the ordering procedures described in

Federal Acquisition Regulation 8.405-3 when placing an order or establishing a BPA for supplies or services. The ordering procedures, information on Blanket Purchase Agreements (BPA’s) and a sample BPA can be found at the GSA/FSS Schedule Homepage (fss.gsa.gov/schedules).

13. PAYMENT ADDRESS: Same as contractor

14. WARRANTY PROVISION: N/A Services Only

15. EXPORT PACKING CHARGES: Not applicable

16. TERMS AND CONDITIONS OF RENTAL, MAINTENANCE, AND REPAIR (IF APPLICABLE): N/A

17. TERMS AND CONDITIONS OF INSTALLATION (IF APPLICABLE): N/A

18a. TERMS AND CONDITIONS OF REPAIR PARTS INDICATING DATE OF PARTS PRICE LISTS AND

ANY DISCOUNTS FROM LIST PRICES (IF AVAILABLE): N/A

18b. TERMS AND CONDITIONS FOR ANY OTHER SERVICES (IF APPLICABLE): N/A

19. LIST OF SERVICE AND DISTRIBUTION POINTS (IF APPLICABLE): N/A

20. LIST OF PARTICIPATING DEALERS (IF APPLICABLE): N/A

21. PREVENTIVE MAINTENANCE (IF APPLICABLE): N/A

22a. SPECIAL ATTRIBUTES SUCH AS ENVIRONMENTAL ATTRIBUTES (e.g. recycled content, energy efficiency, and/or reduced pollutants): N/A

22b. Section 508 Compliance for Electronic and Information Technology (EIT): Section 508 compliance information on the supplies and services in this contract are available at the following website address (URL): The EIT standard can be found at: www.Section508.gov/.

23. DUNS NUMBER: 117336232 and CAGE CODE: 8FKE0

24. NOTIFICATION REGARDING REGISTRATION IN SYSTEM FOR AWARD MANAGEMENT (SAM)

DATABASE: Contractor has an Active Registration in the SAM database.

http://www.section508.gov/

Labor Category Descriptions

Due to the availability or limitation of education, occasionally substitution of experience as referenced below for a professional labor type with additional years of experience will be provided to the Federal Agency when responding to their requirements and it is solely the acquiring agency’s determination, if the substitution is considered acceptable prior to an award.

Please see the below chart for our proposed method of substitutions.

Education Level Substitution

Associates Degree 2 Years of Experience or

1 Year of College Education + 1 Year of Experience

Bachelor’s Degree 4 Years of Experience or

Associates Degree with 2 Years of Experience

Master’s Degree 6 Years of Experience or

Bachelor’s Degree with 2 Years of Experience or

Associates Degree with 4 Years of Experience

PhD 8 Years of Experience or

Master’s Degree with 2 Years of Experience or

Bachelor’s Degree with 4 Years of Experience or

Associates Degree with 6 Years of Experience

Labor Category/Service Title Functional Responsibilities

Minimum Education Minimum Years of Experience (cannot be a range)

Project Manager

Responsible for planning and overseeing projects to ensure they are completed in a timely fashion and within budget. Project managers plan and designate project resources, prepare budgets, monitor progress, and keep stakeholders informed the entire way. Bachelors 5

Quality Assurance Manager

Oversees the activity of the quality assurance department and staff, developing, implementing, and maintaining a system of quality for all deliverables on a specific contract. Bachelors 3

Cybersecurity Manager

Plans and oversees the implementation and provision of cybersecurity services for a contract.

The cybersecurity manager leads all Bachelors 8 security efforts and guides security workers underneath them to the completion of the contract.

Cybersecurity Consultant I

Junior level cybersecurity consultant who will provide various cybersecurity services, including implementation of security controls, conducting various assessments, creating reports, and the creation of documentation. Associates 1

Cybersecurity Consultant II

Senior level cybersecurity consultant who manage junior cybersecurity consultants below them and will provide various cybersecurity services, including implementation of security controls/tools, conducting various assessments, creating reports, and the creation of documentation. Bachelors 5

Cybersecurity Engineer I

Junior level engineer responsible for planning, implementing, managing, monitoring, and upgrading security measures for the protection of the organization's data, systems, and networks, troubleshooting security and network problems, responding to all system and/or network security breaches, ensuring that data and infrastructure are protected by enabling the appropriate security controls. Implements various security tools like Antivirus to ensure that computers are secured, testing and identifying network and system vulnerabilities. Associates 1

Cybersecurity Engineer II

Senior level engineer responsible for planning, implementing, managing, monitoring, and upgrading security measures for the protection of the organization's data, systems, and networks, troubleshooting security and network problems, responding to all system and/or network security breaches, ensuring that data and infrastructure are protected by enabling the appropriate security controls. Implements various security tools like Antivirus to ensure that computers are secured, testing and identifying network and system vulnerabilities. Bachelors 5

Security Analyst I

Junior level security analyst that will work in a SOC environment and handle tier 1 responsibilities which includes threat monitoring/hunting, identification of incidents, notification of clients, and escalation of incidents. Associates 1

Security Analyst II

Mid level security analyst that will work in a SOC environment and handle tier 2 responsibilities which includes threat monitoring/hunting, investigation of incidents, verifying of incidents, communication with clients, basic incident response services, and escalation of incidents. Bachelors 3

Security Analyst III

Senior level security analyst that will oversee all SOC activity and handle tier 3 responsibilities which includes threat hunting, deep investigation of Bachelors 5 incidents, malware analysis, incident response services, creation of reporting, creation of detection logic, communication with clients, and handling of escalated incidents.

SOC Engineer I

Junior level SOC Engineer that will work in a SOC environment and handle the engineering tasks including building/maintenance of the SIEM tool. Bachelors 1

SOC Engineer II

Senior level SOC Engineer that will work in a SOC environment and handle the engineering tasks including building/maintenance of the SIEM tool. Bachelors 5

Penetration Tester I

Junior level penetration tester that will assist in conducting penetration testing assignments. Associates 1

Penetration Tester II

Senior level penetration tester that will take lead on penetration testing assessments and review/create final reports. They will also be in direct contact with clients as needed. Bachelors 5

Application Security Analyst

Performs a security analysis on static code and reports on findings as either false positive or need remediation. Also performs dynamic testing while a live version of the application is running.

This includes providing remediation actions. Bachelors 3

Price List Position Rate - Year 1 Rate - Year 2 Rate - Year 3 Rate - Year 4 Rate - Year 5 Project Manager

$121.37 $124.41 $127.52 $130.71 $133.97

Quality Assurance Manager

$94.21 $96.56 $98.98 $101.45 $103.99

Cybersecurity Manager

$129.42 $132.66 $135.97 $139.37 $142.86

Cybersecurity Consultant I

$85.69 $87.83 $90.03 $92.28 $94.59

Cybersecurity Consultant II

$111.24 $114.03 $116.88 $119.80 $122.79

Cybersecurity Engineer I

$85.69 $87.83 $90.03 $92.28 $94.59

Cybersecurity Engineer II

$111.24 $114.03 $116.88 $119.80 $122.79

Security Analyst I

$68.66 $70.37 $72.13 $73.94 $75.78

Security Analyst II

$81.43 $83.46 $85.55 $87.69 $89.88

Security Analyst III

$94.21 $96.56 $98.98 $101.45 $103.99

SOC Engineer I $89.95 $92.19 $94.50 $96.86 $99.28 SOC Engineer II $102.73 $105.29 $107.93 $110.63 $113.39 Penetration Tester I

$85.69 $87.83 $90.03 $92.28 $94.59

Penetration Tester II

$111.24 $114.03 $116.88 $119.80 $122.79

Application Security Analyst

$94.21 $96.56 $98.98 $101.45 $103.99

Capabilities Anthony Timbers LLC specializes in providing cybersecurity and digital services including:

• Penetration Testing

• Software Assurance

• Vulnerability/Risk Assessments

• Cybersecurity Policy Creation

• Patch Management

• 24x7 Managed Detection and Response (MDR)

• IT Security Planning/Implementation

• Managed Cybersecurity Services

• ICS/SCADA/OT Security Assessments

• Microsoft 365 Consulting, Migration, and Implementation Services

• Website Design Services

Past Performance Organizations in both the public and private sectors have entrusted Anthony Timbers LLC and other members of our project team to assist in proactively securing assets and minimize cybersecurity impact to business operations.

Our experience includes conducting security assessments for large university systems, hospitals, government agencies, and large/small businesses. Below are some of the relevant experiences our team has that qualifies our company to conduct various cybersecurity and IT services.

Public Sector Past Performance Client

City and County of San Francisco

Type of Work Period of Performance Place of Performance

IT Audit Services and Consulting October 2025 - Present Remote

Description

Provided IT audit and consulting services to the City and County of San Francisco under Sourcing Event

0000010987 (RFQ2023-07A), supporting multiple service areas across the City’s IT environment. Services included penetration testing, web application penetration testing, HIPAA security assessments, and IT General

Controls (ITGC) assessments. Additionally, our team delivered IT audit consulting and advisory services related to PCI DSS, IT governance, and internal audit augmentation. Engagements focused on identifying security and control gaps, validating technical safeguards, assessing compliance with applicable regulatory frameworks, and providing actionable remediation recommendations to strengthen the City’s overall security posture.

Client

City of St. Petersburg

Type of Work Period of Performance Place of Performance

PCI-DSS RoC

Audit/Assessment

November 2025 – Present Remote

Description

We currently support the City of St. Petersburg, a level 2 merchant, on a 1-5 year contract conducting PCI-DSS assessments for them as Qualified Security Assessors

(QSAs). We are completing a full Level 1 audit and assessment of their PCI-DSS compliance and completed a RoC/AoC for them.

City of Seattle

Type of Work Period of Performance Place of Performance

IT Consulting Services (PCI DSS

Assessments & Vulnerability

Assessments)

January 2026 - Present Remote

Description

Anthony Timbers LLC was awarded placement on the City of Seattle’s Citywide Consultant Roster for

Information Technology Consulting. Under this award, we support Payment Card Industry (PCI) compliance assessments and vulnerability and security analysis services, including security assessments for small business entities. Our services include PCI DSS compliance assessments, scoping and gap analysis, validation of technical and administrative controls, vulnerability identification, and remediation advisory. The engagement supports the

City’s ongoing efforts to ensure secure payment environments, reduce cyber risk, and maintain compliance with

PCI DSS and broader information security best practices.

Confidential DoD Client

Type of Work Period of Performance Place of Performance

PCI-DSS Consulting and Advisory July 2025 - Present Remote

Description

Currently providing PCI DSS advisory and consulting services to a confidential Department of Defense client operating across more than 100 locations nationwide. Following a recent PCI DSS assessment, our team was engaged to support the remediation of identified gaps and strengthen overall compliance posture. This includes reviewing assessment findings, prioritizing remediation efforts, advising on compensating controls, and aligning remediation activities with PCI DSS 4.0.1 requirements. Our consultants are coordinating with the client’s IT and compliance teams to ensure sustainable compliance, improve control maturity, and prepare the organization for successful future assessments.

Suffolk County, New York

Type of Work Period of Performance Place of Performance

NIST CSF Assessment, External/Internal/Web

Application Penetration Test

September 2023 –

February 2024

Remote

Description

In our role as a third-party provider, we conducted a thorough External/Internal/Web

Application Penetration Test and NIST CSF 1.0 Assessment for the county, spanning 14 departments. Our expert team meticulously assessed the security of the County's systems and web applications, identifying vulnerabilities and potential risks on a network of 10,000+ devices. The compliance portion of the assessment covered interviewing SMEs from each department and analyzing all available security documentation and cross referencing it with the NIST CSF framework to determine gaps in compliance. By delivering actionable insights and recommendations, we assisted the

County in enhancing its cybersecurity defenses and fortifying its infrastructure, thereby safeguarding sensitive information and ensuring compliance with NIST Cybersecurity

Framework standards.

City of Bakersfield, CA

Type of Work Period of Performance Place of Performance

External/Internal/Web Application Testing September 2024 – January 2025 Remote and On-Site

Description

We conducted a comprehensive penetration test for the City of Bakersfield, CA, encompassing over 5,000 external and internal addresses. The assessment included external and internal network penetration testing and vulnerability scanning, Wi-Fi penetration testing, and a detailed penetration test/assessment of the Active Directory environment.

Our approach identified critical vulnerabilities and misconfigurations, providing actionable recommendations to enhance the client’s overall security posture and safeguard their IT infrastructure.

US Marine Corps

Type of Work Period of Performance Place of Performance

External/Internal/Web Application PCI-

DSS Penetration Testing and Targeted

Risk Analysis, PCI 4.0.1 Annual QSA

Audit (RoC/AOC)

June 2024 - Present Remote and On-Site

Description

Currently on a 5-year contract with the Marine Corps to provide annual External/Internal PCI-DSS Penetration Testing

Services for their large CDE network (500+ /24 subnets, 20,0000+ devices) well as providing Annual Targeted Risk

Analysis services in support of PCI-DSS 4.0 compliance. Our firm also conducts MCCS’ annual RoC and PCI-DSS

Audit.

NJ Transit

Type of Work Period of Performance Place of Performance

PCI-DSS Audit/Assessment, PCI 4.0 Gap

Assessment and Audit

November 2023 - Present Remote and On-Site

Description

We currently support NJ Transit, a level 1 merchant, on a 3 year contract conducting PCI-DSS assessments for them as

Qualified Security Assessors (QSAs). We completed a full Level 1 audit and assessment of their PCI-DSS compliance and completed a RoC/AoC for them and will be conducting this for the next 3 years, including mandatory on-site visits for parts of the assessment each year. A gap analysis from PCI-DSS v3.2.1 to v4 is also being conducted. A review of all their cybersecurity practices for their in-scope environment was completed and recommendations/remediations for deficiencies were provided.

State of New Hampshire

Type of Work Period of Performance Place of Performance

PCI-DSS Forensics Investigations February 2024 – Present Remote

Description

We currently provide comprehensive PCI DSS forensic investigation services to various state agencies upon request, leveraging advanced forensic techniques to assess and enhance their payment system security. Our expert team conducts detailed analyses to identify compliance gaps and vulnerabilities, ensuring adherence to the highest standards of data protection. Through our specialized incident response and training programs, we empower agencies to effectively safeguard sensitive cardholder information against potential breaches and fraud.

CA Department of Parks and Recreation

Type of Work Period of Performance Place of Performance

PCI-DSS ASV Scanning and

Penetration Testing

May 2023 - Present Remote

Description

We are currently providing PCI-DSS vulnerability scanning quarterly and penetration testing as required in support of the department’s PCI-DSS compliance efforts. We will be using an ASV solution (Tenable.io) for scanning and conducting network and web application penetration tests on in scope-environments for 16 months.

City of St. Charles, IL

Type of Work Period of Performance Place of Performance

Managed Cybersecurity Services, PCI-

DSS Penetration Testing/ASV Scanning, Vulnerability Scanning and Program

Management, General Network

Penetration Testing

June 2023 - Present Remote

Description

We are providing full managed cybersecurity services for the entire city. This includes SIEM implementation/monitoring, vulnerability management, annual risk assessments, network/application penetration tests, 24x7 network monitoring, incident response services, and other cybersecurity consulting engagements as needed. PCI-DSS ASV scanning and penetration testing is also handled/managed by our team.

Suffolk County, New York

Type of Work Period of Performance Place of Performance

NIST CSF Assessment, External/Internal/Web Application

Penetration Test

September 2023 - February Remote

Description

In our role as a third-party provider, we conducted a thorough External/Internal/Web Application Penetration Test as part of the County's NIST CSF Assessment. Our expert team meticulously assessed the security of the County's systems and web applications, identifying vulnerabilities and potential risks on a network of 10,000+ devices. By delivering actionable insights and recommendations, we assisted the County in enhancing its cybersecurity defenses and fortifying its infrastructure, thereby safeguarding sensitive information and ensuring compliance with NIST

Cybersecurity Framework standards.

Massachusetts Office of the State Auditor

Type of Work Period of Performance Place of Performance

Cybersecurity Architecting, Cybersecurity Consulting, Compliance

Assessment/Implementation

July 2022 – March 2025 Remote

Description

We are currently performing on a contract as the Information Security Architect for the Massachusetts Office of the State Auditor. Our job includes conducting an initial cybersecurity assessment on the network as a whole and documenting compliance with applicable NIST/CIS controls. We are providing ongoing cybersecurity architecting services, which includes conducting risk assessments, architecting a more secure environment, building out a formalized security program, implementing security controls and tools, creating and formalizing security policies/procedures, assisting with migration to Office 365 cloud, securing the cloud O365 tenant, hardening network devices and servers, and making overall recommendations to improve their security posture.

Ohio University

Type of Work Period of Performance Place of Performance

NIST 800-171 Consulting, Cybersecurity Consulting

February 2023 – February 2025 Remote

Description

We performed on a contract with Ohio University to provide CMMC consulting and readiness/gap assessments for 35+ Ohio small businesses. Work included determining scope of CMMC compliance for each business (Level

1 vs Level 2), assessing compliance with each control, and providing remediation details and recommendations to improve their compliance and cybersecurity overall. Our team conducted approximately 30+ level 2 assessments/consulting for small-medium sized businesses.

Virginia Retirement System

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, Penetration

Testing

May 2023 - Present Remote

Description

Providing various cybersecurity services, primarily based around penetration testing and cybersecurity/compliance assessments to agencies in VA. Since it is a cooperative purchasing agreement, VA agencies can utilize the contract for cybersecurity consulting as needed via eVA.

San Joaquin County Government

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, Compliance

Assessment, Zero Trust Architecting

October 2021 – June 2022 Remote

Description

We are working on a contract with the San Joaquin County Sherriff’s Department to conduct both a cybersecurity assessment of their network and implement the Microsoft Zero Trust Strategy for their 365 environments. We have completed the initial cybersecurity posture assessment and are currently implementing various Zero Trust features for them. In this effort, we conducted an assessment and determined the current levels of risk that they face, where their cybersecurity gaps currently are, and providing recommendations on how they can improve their cybersecurity overall. This included assessing compliance with NIST 800-171/CMMC as well.

GENEDGE

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, CMMC

Compliance, Managed Security

Services, Vulnerability/Risk

Assessments

May 2021 – Present Remote

Description

We work directly with GENEDGE on implementing remediation actions for clients that need to be CMMC compliant. We typically implement all the NIST 800-171 controls for their secure enclaves that we build out and act as their Managed Security Service provider if requested and continually manage their security program, which includes conducting vulnerability assessments weekly, patch management, conducting SIEM monitoring, conducting Incident Response, and managing other security tools we deploy. An initial assessment is done on the organizations we work with to determine what needs to be implemented. We provide our recommendations and gameplan for improving their cybersecurity posture.

Maricopa County

Type of Work Period of Performance Place of Performance

Penetration Testing, Cybersecurity

Consulting

December 2022- Present Remote/Onsite

Description

Providing Penetration testing services to the county and all of Arizona, to include Internal, External, Web

Application, and other forms of penetration testing. General Cybersecurity Consulting is also provided under this contract.

City of Palm Beach Gardens, Florida

Type of Work Period of Performance Place of Performance

External/Internal Penetration Testing, CIS v8 Assessment

May 2024 - August 2024 Remote/Onsite

Description

We provided external and internal penetration testing services to the City along with a full CIS v8 assessment which included a number of interviews with key staff, detailed documentation/evidence reviews, and generation of reports for each activity.

Town of Palm Beach, Florida

Type of Work Period of Performance Place of Performance

External/Internal Penetration Testing August 2024 – Present Remote/Onsite

Description

We are currently providing external and internal penetration testing services to the Town of Palm Beach, including Wireless Security testing, for their large internal network.

Hawaii Department of Business, Economic Development & Tourism

Type of Work Period of Performance Place of Performance

External/Internal Penetration Testing August 2024 - Present Remote

Description

As part of the Hawaii Cyber Safe Program, we are conducting penetration testing for up to 40 small businesses to enhance their cybersecurity resilience. To date, we have been assigned approximately 10 businesses, performing tailored assessments that include external and internal penetration testing, vulnerability scanning, and network security evaluations. Our work helps small businesses identify and mitigate security risks, empowering them to protect sensitive data and maintain compliance with industry standards.

State of New Hampshire Employment Security

Type of Work Period of Performance Place of Performance

PCI-DSS Forensics Investigations, Penetration Testing

October 2024 – November 2024 Remote

Description

Provided extensive forensics investigation services and penetration testing services after a breach was reported for the

NHES. We did a deep, thorough investigation of logs and activity and provided an actionable report. We also conducted a penetration test to see if the environment and web application was still at-risk post incident. We have an ongoing agreement to conduct quarterly penetration testing with this unit as well.

United States Department of Army

Type of Work Period of Performance Place of Performance

Static Code Analysis/Software Assurance January 2020 – September 2020 Remote

Description

Conducted static code analysis using HP Fortify and CodeDX, identifying code vulnerabilities in 19 custom applications, and providing recommendations for remediation.

U.S. Dept. of Veterans Affairs

Type of Work Period of Performance Place of Performance

Web Application Security Assessment July 2020 – July 2020 Remote

Description

Security assessment of a VA web application, vulnerability identification, and remediation reporting.

James Madison University

Type of Work Period of Performance Place of Performance

External/Internal/Web Application Testing April 2025 - Present Remote and On-Site

Description

Currently working on a contract for up to 10 years (1 year base period with 9 option years) providing JMU and any other college in the state of Virginia with various IT Security Services, including: Vulnerability Scanning, Wireless

Penetration Testing, Network Penetration Testing, Database Architecture Security Assessments, Firewall/Router

Security Assessments, Active Directory Security Assessments, Web Application Penetration Testing, and Server

Configuration Assessments.

Private Sector Past Performance

Polimaster Inc.

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, CMMC

Compliance, Managed Security

Services, Vulnerability/Risk

Assessments

December 2021 - Present Remote

Description

We worked directly with Polimaster Inc., a DoD contractor, on implementing a secure CMMC enclave in Office

365 and making recommendations to formalize and improve their security program. We provided cybersecurity consulting services and implemented all the NIST 800-171 controls for their secure enclave. We now act as their

Managed Security Service provider and continually manage their security program, which includes conducting vulnerability assessments weekly, conducting SIEM monitoring, conducting Incident Response, and managing the XDR tool we deployed for them.

Apex Microdevices, LLC

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, CMMC

Compliance, Managed Security

Services, Vulnerability/Risk

Assessments

April 2024 - Present Remote

Description

We now act as their Managed Security Service provider and continually manage their security program, which includes conducting vulnerability assessments weekly, conducting SIEM monitoring 24x7, conducting Incident

Response, managing documentation and compliance programs, and managing the XDR tool we deployed for them.

Innovision LLC

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, CMMC

Compliance, Managed Security

Services, Vulnerability/Risk

Assessments

December 2023 - Present Remote

Description

We act as their Managed Security Service provider and continually manage their security program, which includes conducting vulnerability assessments weekly, conducting SIEM monitoring 24x7, conducting Incident

Summit Environmental Solutions

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, CMMC

Compliance, Managed Security

Services, Vulnerability/Risk

Assessments

August 2025 – Present Remote

Description

We act as as their Managed Security Service provider and continually manage their security program, which includes conducting vulnerability assessments weekly, conducting SIEM monitoring 24x7, conducting Incident

Orion Strategic Solutions

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, CMMC

Compliance, Managed Security

Services, Vulnerability/Risk

Assessments

June 2025 – Present Remote

Description

We act as their Managed Security Service provider and continually manage their security program, which includes conducting vulnerability assessments weekly, conducting SIEM monitoring 24x7, conducting Incident

Tollanis

Type of Work Period of Performance Place of Performance

PCI-DSS Consulting/Assessment, SAQ/AOC Completion, Vulnerability

Scanning, Penetration Testing

May 2024 – Present Remote

Description

We provided comprehensive SAQ D consulting and assessment services, assisting the client in achieving PCI

DSS compliance. Our support included assessment and guidance on PCI requirements, penetration testing, ASV and vulnerability scanning, and control implementation, while maintaining strict independence throughout the process. These efforts culminated in the successful completion of an Attestation of Compliance (AOC), anticipated for February 2025, ensuring the client's secure and compliant payment processing environment.

Multistate Partnership for Prevention

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, HIPAA/NIST

Compliance, Penetration Testing, Vulnerability/Risk Assessments

July 2020- May 2021 Remote

Description

Managed Cybersecurity & HIPAA Compliance effort for a nationally used healthcare application known as

PrepMod. We were brought in to do a security assessment of the application and their organization and to make recommendations on how to improve the security posture of each, followed by actually implementing them.

Duties included conducting risk assessments, network/web application penetration testing, source code analysis, vulnerability assessments, application security implementation, AWS security management, cybersecurity consulting and engineering, and HIPAA compliance implementation/management.

Cino Security Solutions

Type of Work Period of Performance Place of Performance

External Penetration Testing and

Vulnerability scanning

February 2020 - Present Remote

Description

External Penetration Testing for a large number of clients using public IP addresses. Testing covers network and website/web app penetration testing. We went/go through a robust external penetration testing methodology that includes conducting reconnaissance, port scanning, vulnerability scanning, and enumerating vulnerabilities using a number of penetration testing tools. The overall goal is to gain some type of access to the network or device from the outside, which we have achieved on multiple occasions. A penetration testing report is generated after each engagement that contains all steps taken and detailed remediation actions to take. All testing is 100% blackbox. We make recommendations to clients on how they can improve their cybersecurity posture based on our findings.

Immigrant Legal Resource Center

Type of Work Period of Performance Place of Performance

External/Internal Vulnerability Scanning and Penetration Testing

July 2020 - August 2020 Remote

Description

Internal and External security assessment of infrastructure and corporate networks (100+ devices). The external portion of this assessment included penetration testing and vulnerability scanning multiple websites/web applications, as well as the edge devices of the network (firewalls/routers). Internally, we conducted penetration testing on the active directory domain and looked for exploitable vulnerabilities in servers and workstations.

Vulnerability scanning was conducted internally as well to detect potential vulnerabilities in systems on the network. We made recommendations to the organization on how to improve their cybersecurity posture based on the findings from our assessment.

Skysoft Inc.

Type of Work Period of Performance Place of Performance

Web Application, External, and Internal

Penetration Testing and Vulnerability

Assessments

January 2020 – Present Remote

Description

Internal and External Penetration Testing of infrastructure and corporate networks (200+ devices). While on the internal network of a healthcare organization, we stepped through our penetration testing methodology in order to discover any potentially exploitable vulnerabilities. Vulnerability scanning and testing of the Active directory domain were in scope for this assessment as well. We also conduct web application penetration testing on healthcare applications that require HIPAA compliance. We conducted a number of automated and manual tactics in order to uncover a number of vulnerabilities in the deployed healthcare application. The testing was

Blackbox testing primarily, as well as some testing using credentials for the web application and vulnerability scans separately.

Red Roof Inn

Type of Work Period of Performance Place of Performance

PCI-DSS Consulting/Assessment, SAQ/AOC Completion

April 2024 – January 2025 Remote

Description

We assisted 375+ Red Roof Inn locations in achieving PCI DSS compliance by completing Self-Assessment

Questionnaires (SAQ-D and AOC) for each location and conducting thorough reviews of their cybersecurity practices. Our expert guidance ensured that all locations adhered to stringent industry standards, enhancing security measures and maintaining consistent compliance across the board.

Veetrends

Type of Work Period of Performance Place of Performance

PCI-DSS Consulting, PCI-

DSS/Cybersecurity Policy Generation, SAQ/AOC Completion

January 2024 - Present Remote

Description

We currently work with Veetrends, a large E-Commerce brand, on a recurring basis related to PCI-DSS consulting. We initially conducted scoping and gapping of their compliance with the latest PCI 4.0 standard and completed an SAQ for their organization to submit to their acquirer. We also are working with them to generate and implement information security policies to come in to compliance with PCI-DSS requirements.

Dock

Type of Work Period of Performance Place of Performance

PCI-DSS Consulting, PCI-

DSS/Cybersecurity Policy Generation

October 2022- November 2022 Remote

Description

We worked with Dock, a company that runs a parking payment application popular with cities, to assist them in generating cybersecurity documentation for their PCI-DSS compliance program and consulted them on understanding the various requirements and how they could meet them.

Multistate Partnership for Prevention

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, HIPAA/NIST

Compliance, Penetration Testing, Vulnerability/Risk Assessments

July 2020- May 2021 Remote

Description

Managed Cybersecurity & HIPAA Compliance effort for a nationally used healthcare application known as

PrepMod. We were brought in to do a security assessment of the application and their organization and to make recommendations on how to improve the security posture of each, followed by actually implementing them.

Duties included conducting risk assessments, network/web application penetration testing, source code analysis, vulnerability assessments, application security implementation, AWS security management, cybersecurity consulting and engineering, and HIPAA compliance implementation/management.

Polimaster Inc.

Type of Work Period of Performance Place of Performance

Cybersecurity Consulting, CMMC

Compliance, Managed Security

Services, Vulnerability/Risk

Assessments

December 2021 - Present Remote

Description

We worked directly with Polimaster Inc., a DoD contractor, on implementing a secure CMMC enclave in Office

365 and making recommendations to formalize and improve their security program. We provided cybersecurity consulting services and implemented all the NIST 800-171 controls for their secure enclave. We now act as their

Managed Security Service provider and continually manage their security program, which includes conducting vulnerability assessments weekly, conducting SIEM monitoring, conducting Incident Response, and managing the XDR tool we deployed for them.

Cino Security Solutions

Type of Work Period of Performance Place of Performance

External Penetration Testing and

Vulnerability scanning

February 2020 - Present Remote

Description

External Penetration Testing for a large number of clients using public IP addresses. Testing covers network and website/web app penetration testing. We went/go through a robust external penetration testing methodology that includes conducting reconnaissance, port scanning, vulnerability scanning, and enumerating vulnerabilities using a number of penetration testing tools. The overall goal is to gain some type of access to the network or device from the outside, which we have achieved on multiple occasions. A penetration testing report is generated after each engagement that contains all steps taken and detailed remediation actions to take. All testing is 100% blackbox. We make recommendations to clients on how they can improve their cybersecurity posture based on our findings.

Immigrant Legal Resource Center

Type of Work Period of Performance Place of Performance

External/Internal Vulnerability Scanning and Penetration Testing

July 2020 - August 2020 Remote

Description

Internal and External security assessment of infrastructure and corporate networks (100+ devices). The external portion of this assessment included penetration testing and vulnerability scanning multiple websites/web applications, as well as the edge devices of the network (firewalls/routers). Internally, we conducted penetration testing on the active directory domain and looked for exploitable vulnerabilities in servers and workstations.

Vulnerability scanning was conducted internally as well to detect potential vulnerabilities in systems on the network. We made recommendations to the organization on how to improve their cybersecurity posture based on the findings from our assessment.

Skysoft Inc.

Type of Work Period of Performance Place of Performance

Web Application, External, and Internal

Penetration Testing and Vulnerability

Assessments

January 2020 – Present Remote

Description

Internal and External Penetration Testing of infrastructure and corporate networks (200+ devices). While on the internal network of a healthcare organization, we stepped through our penetration testing methodology in order to discover any potentially exploitable vulnerabilities. Vulnerability scanning and testing of the Active directory domain were in scope for this assessment as well. We also conduct web application penetration testing on healthcare applications that require HIPAA compliance. We conducted a number of automated and manual tactics in order to uncover a number of vulnerabilities in the deployed healthcare application. The testing was

Blackbox testing primarily, as well as some testing using credentials for the web application and vulnerability scans separately.

Project Team Past Related Performance Below are some relevant past performance descriptions for projects that members of our proposed team have completed or participated in outside of our organization.

Client

First Citizens Bank

Type of Work Period of Performance Place of Performance

PCI-DSS Audit/Advisory July 2022 – February 2023 Remote

Description

Conducted PCI DSS certification for a large bank, starting with scoping the bank's environment to identify systems handling cardholder data. Followed with a gap analysis to test the bank's readiness against PCI DSS requirements. The next step involved implementing a remediation plan to address these gaps, which included new identity management technologies, revised policies, and reconfigured network infrastructure. After this, comprehensive tests were conducted to ensure these controls met PCI DSS standards. Once remediation was complete, a full PCI DSS assessment resulting in a Report on Compliance (RoC) was conducted. FCB submitted the AOC to the acquiring bank and card brands. Post-certification, the bank was assisted in maintaining compliance through regular monitoring, auditing, and annual reassessment, working closely with the bank's internal teams, utilizing various tools like network scanning systems, File Integrity Monitoring (FIM) tools, Security Information and Event Management (SIEM) tools, and configuration management tools.

Michigan Department of Transport

Type of Work Period of Performance Place of Performance

PCI-DSS Audit/Advisory January 2021 – September 2021 Remote

Description

Over a nine-month engagement with the Michigan Department of Transportation (MDOT), first conducted a comprehensive audit of MDOT's existing security infrastructure and practices identifying gaps with PCI DSS requirements and creating a tailored remediation plan. This plan incorporated the implementation of new standards and procedures, policy revisions, and system configuration modifications to enhance cybersecurity measures. Following successful implementation, controls were thoroughly retested these new security measures.

Also provided training to MDOT personnel, equipping them with the knowledge to adhere to and maintain these enhanced security practices. After a conclusive review and validation of the improvements, MDOT was guided through an intensive audit resulting in a Report on Compliance.

Columbia Sportswear Company

Type of Work Period of Performance Place of Performance

PCI-DSS v3.2.1 Merchant Readiness

Assessment

April 2022 – December 2022 Remote

Description

Performed a gap assessment against PCI-DSS 3.2.1 controls for a global outdoor apparel company to ready them for a third-party QSA audit. Managed project using ZenGRC compliance tool to track requests to close gaps and for evidence repository. Led PCI scope and segmentation process to identify areas where scope could be minimized using segmentation. Reviewed network and data flow diagrams and reviewed existing firewall rules to update access control rules for segmentation update. Created Rapid7 InsightVM scan templates to meet PCI-DSS vulnerability scanning controls. Performed internal vulnerability scans and re-scans for entire organization, including PCI-DSS Cardholder Data Environment. Performed internal and external penetration testing using Kali

Linux security tools based on exploitable vulnerabilities found during scanning. Interviewed pertinent resources against controls. Gathered and tested evidence and tracked compliance. Provided remediation guidance for non-compliant gaps identified. Created or updated Policies, Procedures, and Standards to meet PCI DSS requirements.

Confidential Client

Type of Work Period of Performance Place of Performance

PCI-DSS Audit (RoC) March 2023 – August 2023 Remote

Description

Performed a v4.0 PCI-DSS assessment and completed a ROC for a security services company with cloud-based services. The services and solutions offered detect and defend against unwanted automated activity on web and mobile assets and properties, DDOS attack mitigation services, and web application firewall (WAF) services.

Led project from initial kickoff reviewing the business description and verifying scoping to testing and validating all evidence to AOC signing.