MAS - Zephon LLC - 47QTCA21D00C4

GENERAL SERVICES ADMINISTRATION

FEDERAL SUPPLY SERVICE

AUTHORIZED FEDERAL SUPPLY SCHEDULE CATALOG/PRICE LIST

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order is available through GSA Advantage! a menu-driven database system. The

INTERNET address for GSA Advantage! is http://www.gsaadvantage.gov

SCHEDULE TITLE: Multiple Award Schedule (MAS) Federal Supply Group: Information Technology

CONTRACT NUMBER: 47QTCA21D00C4

CONTRACT PERIOD: July 12, 2021 through July 11, 2026

Pricelist current through Mod PS-0017, eff 07-29-2025

Contractor:

Zephon LLC

4028 Hibiscus Dr McKinney, TX 75071

Phone: 469-343-4371 Website: www.zephon.tech

Contract Administrator: Vishal Masih

Email: vmasih@zephon.tech

UEI: QX54CCLJ6F55

NAICS Code(s): 541512, 541511, 541519, 541513, 541611, 541614, 541618, 541690, 561110, 513210, 518210, 611420

BUSINESS SIZE: Minority-Owned Business, S Corporation, Small Disadvantaged Business, Subcontinent Asian (Asian-Indian) American Owned

FSC Classes/Product Codes: DJ01 - IT and Telecom - Security and Compliance Support Services (Labor)

For more information on ordering from Federal Supply Schedules click on the FSS Schedules button at:

http://fss.gsa.gov/.

GSA MAS Schedule

GSA SCHEDULE # 47QSMD20R0001

Contract # 47QTCA21D00C4 Zephon LLC

Table of Contents

1.0 Terms and Conditions Applicable to all SINs

2.0 Terms and Conditions Applicable to Information Technology Services (54151S)

2.0 Terms and Conditions Applicable to Identity, Credentialing, and Access Management (ICAM) (SIN

541519ICAM)

3.0 Terms and Conditions Applicable to Highly Adaptive Cybersecurity Services (HACS) (SIN

54151HACS)

3.0 Labor Category Pricing

4.0 Labor Category Descriptions

5.0 OLM - SPECIAL ORDERING PROCEDURES FOR THE ACQUISITION OF ORDER-LEVEL

MATERIALS (MAY 2019)

1.0 Terms and Conditions Applicable to all SINs

1a. Table of awarded special item number(s) with appropriate cross-reference to item descriptions and awarded price(s).

SINs Recovery SIN Title

54151HACS 54151HACSRC Highly Adaptive Cybersecurity Services (HACS)

54151S 54151SRC Information Technology Services

541519ICAM 541519ICAM Identity, Credentialing, and Access Management

OLM OLMRC ORDER-LEVEL MATERIALS (OLM)

1b. Identification of the lowest priced model number and lowest unit price for that model for each special item number awarded in the contract. This price is the Government price based on a unit of one, exclusive of any quantity/dollar volume, prompt payment, or any other concession affecting price. Those contracts that have unit prices based on the geographic location of the customer, should show the range of the lowest price, and cite the areas to which the prices apply. See Page 11.

1c. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles, experience, functional responsibility, and education for those types of employees or subcontractors who will perform services shall be provided. If hourly rates are not applicable, indicate “Not applicable” for this item. See Page 11.

2. Maximum order: $500,000 (54151HACS); $500,000 (54151S); $1,000,000 (541519ICAM)

3. Minimum order: $100

4. Geographic coverage (delivery area). Domestic; 50 States, DC and Territories.

5. Point(s) of production (city, county, and State or foreign country). 4028 Hibiscus Dr, McKinney, TX 75071

6. Statement of net price. See page 11.

7. Quantity discounts. 1.5% equal to or greater than $150,000.

8. Prompt payment terms. Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions. 1.0% if Payment is made within 7 Days.

9. Foreign items (list items by country of origin). Not Applicable.

10a. Time of delivery. Contact Contractor or To Be Determined at the Task Order level.

10b. Expedited Delivery. Items available for expedited delivery are noted in this price list.

Contact Contractor or To Be Determined at the Task Order level.

10c. Overnight and 2-day delivery. Contact Contractor or To Be Determined at the Task Order level.

10d. Urgent Requirements. Contact Contractor or To Be Determined at the Task Order level.

11. F.O.B. point(s). Destination.

12a. Ordering address(es). 4028 Hibiscus Dr, McKinney, TX 75071

12b. Ordering procedures: For supplies and services, the ordering procedures, information on Blanket Purchase Agreements (BPA’s) are found in Federal Acquisition Regulation (FAR) 8.405-3.

13. Payment address(es). 4028 Hibiscus Dr, McKinney, TX 75071

14. Warranty provision. Standard Commercial Warranty Terms & Conditions.

15. Export packing charges, if applicable. Not Applicable.

16. Terms and conditions of rental, maintenance, and repair (if applicable). Not Applicable.

17. Terms and conditions of installation (if applicable). Not Applicable.

18a. Terms and conditions of repair parts indicating date of parts price lists and any discounts from list prices (if applicable). Not Applicable.

18b. Terms and conditions for any other services (if applicable). Not Applicable.

19. List of service and distribution points (if applicable). Not Applicable.

20. List of participating dealers (if applicable). Not Applicable.

21. Preventive maintenance (if applicable). Not Applicable.

22a. Special attributes such as environmental attributes (e.g., recycled content, energy efficiency, and/or reduced pollutants). Not Applicable.

22b. If applicable, indicate that Section 508 compliance information is available on Electronic and Information Technology (EIT) supplies and services and show where full details can be found (e.g. contractor’s website or other location.) The EIT standards can be found at:

www.Section508.gov/. Not Applicable.

23. Unique Entity ID: QX54CCLJ6F55

24. Cage Code. 8BEH7

25. Notification regarding registration in System for Award Management (SAM) database.

Contractor registered and active in SAM. SAM Unique Entity ID: QX54CCLJ6F55

2.0 Terms and Conditions Applicable to Information

Technology Services (54151S)

54151S covers IT Professional Services including systems analysis, design, programming, testing, and implementation support. It also encompasses cloud migration, IT project management, systems engineering, and cybersecurity architecture support. Vendors under this SIN are skilled in delivering technical expertise across federal IT modernization efforts, digital services transformation, and agile solution development—supporting mission-critical technology outcomes with tailored, hands-on services.

Vendor suitability for offering services through the 54151S SIN must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

• Federal Acquisition Regulation (FAR) Part 52.204-21

• OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of Personally Identifiable Information (PII)

• OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program

• 2017 Report to the President on Federal IT Modernization

• The Cybersecurity National Action Plan (CNAP)

• NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology Systems

• NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security)

• NIST SP 800-30 - Guide for Conducting Risk Assessments

• NIST SP 800-35 - Guide to Information Technology Security Services

• NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations: A Systems Life Cycle Approach for Security and Privacy

• NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View

• NIST SP 800-44 - Guidelines on Securing Public Web Servers

• NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

• NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

• NIST SP 800-61 - Computer Security Incident Handling Guide

• NIST SP 800-64 - Security Considerations in the System Development Life Cycle

• NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

• NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

• NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment

• NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information Systems

• NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

• NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

• NIST SP 800-160 - Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

• NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and Organizations

2.1 SCOPE

a. The labor categories, prices, terms and conditions stated under Special Item Number 54151S SIN apply exclusively to the Information Technology services within the scope of this Multiple Award Schedule (MAS).

b. Services under this SIN are limited to Information Technology Services only. Software and hardware products are under different Special Item Numbers on Multiple Award Schedule (MAS) (e.g. 511210, 33411), and may be quoted along with services to provide a total solution.

c. This SIN provides ordering activities with access to Information Technology services only.

d. Information Technology Services provided under this SIN shall comply with all cybersecurity certifications and industry standards as applicable pertaining to the type of services as specified by ordering agency.

e. SCOPE:

54151S Information Technology Professional Services – SUBJECT TO COOPERATIVE PURCHASING – includes a broad range of technical and functional IT services to support the full lifecycle of IT systems and solutions. The scope of this SIN covers services such as systems analysis, design, development, implementation, integration, and operations and maintenance. These services enable federal, state, and local agencies to modernize IT infrastructure, enhance service delivery, and align with mission objectives.

Services may include cloud architecture and migration, enterprise IT strategy, IT project and program management, DevSecOps support, agile development, and cybersecurity integration. This SIN also supports services related to business intelligence, data analytics, database administration, and application modernization. Personnel provided under this SIN are experienced in both legacy and emerging technologies and bring specialized expertise to improve scalability, performance, and security of government IT systems.

54151S offers agencies the flexibility to procure a wide variety of IT professional services under a single contract vehicle, promoting faster acquisition cycles and mission-aligned outcomes. Services can be delivered onsite, offsite, or via hybrid models depending on agency needs.

f. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2.2 Order

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket Purchase Agreements, individual purchase orders, or task orders for ordering services under this contract.

Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

2.3 Performance of Services

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity. All Contracts will be fully funded.

b. The Contractor agrees to render services during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of Information Technology Professional Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use the GSA City Pair Program for travel in support of any contracts. All travel will be agreed upon with the client prior to the Contractor’s travel.

2.4 Inspection of Services

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND CONDITIONS– COMMERCIAL ITEMS (Jan 2017) & (ALTERNATE I-Jan 2017) for Time-and-Materials and Labor-Hour orders placed under this contract.

2.5 Responsibilities of the Contractor

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (May 2014) Rights in Data – General, may apply.

The Contractor shall comply with contract clause (52.204-21) to the Federal Acquisition Regulation (FAR) for the basic safeguarding of contractor information systems that process, store, or transmit Federal data received by the contract in performance of the contract. This includes contract documents and all information generated in the performance of the contract.

2.6 Responsibilities of the Ordering Activity

Subject to the ordering activity security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Information Technology Professional Services.

2.7 Independent Contractor

All Information Technology Professional Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

2.8 Organizational Conflicts of Interest

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refer to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or

(ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

2.9 Invoices

The Contractor, upon completion of the work ordered, shall submit invoices for Information Technology Professional Services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

2.10 Resumes

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

2.11 Approval of Subcontracts

The ordering activity may require that the Contractor receive, from the ordering activity Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

2.12 Description of Information Technology Professional Services and Pricing Please refer to the labor category description and pricing incorporated into this price

2.0 Terms and Conditions Applicable to Identity, Credentialing, and Access Management (ICAM) (SIN

541519ICAM)

The 541519ICAM SIN focuses on Identity Credential and Access Management (ICAM) solutions. It includes services for identity proofing, access control design, digital identity lifecycle management, multi-factor authentication (MFA), single sign-on (SSO), privilege and role-based access control, and directory services. Vendors listed under this SIN provide full-spectrum ICAM capabilities including strategy, engineering, integration, and operations support—enabling secure and frictionless user access across government systems.

Vendor suitability for offering services through the 541519ICAM SIN must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

• Federal Acquisition Regulation (FAR) Part 52.204-21

• OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of Personally Identifiable Information (PII)

• OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program

• 2017 Report to the President on Federal IT Modernization

• The Cybersecurity National Action Plan (CNAP)

• NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology Systems

• NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security)

• NIST SP 800-30 - Guide for Conducting Risk Assessments

• NIST SP 800-35 - Guide to Information Technology Security Services

• NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations: A Systems Life Cycle Approach for Security and Privacy

• NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View

• NIST SP 800-44 - Guidelines on Securing Public Web Servers

• NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

• NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

• NIST SP 800-61 - Computer Security Incident Handling Guide

• NIST SP 800-64 - Security Considerations in the System Development Life Cycle

• NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

• NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

Systems and Organizations

• NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

• NIST SP 800-160 - Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

• NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and Organizations

2.1 SCOPE

a. The labor categories, prices, terms and conditions stated under Special Item Number 541519ICAM SIN apply exclusively to the “Identity, Credentialing, and Access Management” services within the scope of this Multiple Award Schedule (MAS).

b. Services under this SIN are limited to Identity Credential and Access Management (ICAM) services only. Software and hardware products are under different Special Item Numbers on Multiple Award Schedule (MAS) (e.g. 511210, 33411), and may be quoted along with services to provide a total solution.

c. This SIN provides ordering activities with access to Identity Credential and Access Management (ICAM) services only.

d. Identity Credential and Access Management (ICAM) services provided under this SIN shall comply with all cybersecurity certifications and industry standards as applicable pertaining to the type of services as specified by ordering agency.

e. SCOPE:

541519ICAM Identity Credential and Access Management (ICAM) – SUBJECT TO COOPERATIVE PURCHASING – provides a full suite of services and solutions that enable secure, efficient, and user-friendly access to government systems and data. This SIN supports the implementation and sustainment of ICAM capabilities aligned with federal mandates, including identity proofing, credential issuance and management, access governance, directory services, authentication (including multi-factor authentication), authorization, single sign-on (SSO), and privileged access management (PAM).

The scope also includes support for identity lifecycle management, federated identity services, public key infrastructure (PKI), role- and attribute-based access controls, and enterprise identity directories.

Services may span strategy development, architecture and engineering, implementation, integration with cloud and on-prem systems, and ongoing operations and maintenance.

541519ICAM is designed to help agencies achieve Zero Trust principles, reduce identity-related risks, and improve user experience while ensuring compliance with federal ICAM policies such as FICAM, OMB, and NIST guidelines. Work may be performed at the contractor’s site, on government premises, or via secure remote delivery, as mutually agreed.

f. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2.2 Order

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket Purchase Agreements, individual purchase orders, or task orders for ordering services under this contract.

Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

2.3 Performance of Services

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity. All Contracts will be fully funded.

b. The Contractor agrees to render services during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of Identity Credential and Access Management (ICAM) services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use the GSA City Pair Program for travel in support of any contracts. All travel will be agreed upon with the client prior to the Contractor’s travel.

2.4 Inspection of Services

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND CONDITIONS– COMMERCIAL ITEMS (Jan 2017) & (ALTERNATE I-Jan 2017) for Time-and-Materials and Labor-Hour orders placed under this contract.

2.5 Responsibilities of the Contractor

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (May 2014) Rights in Data – General, may apply.

The Contractor shall comply with contract clause (52.204-21) to the Federal Acquisition Regulation (FAR) for the basic safeguarding of contractor information systems that process, store, or transmit Federal data received by the contract in performance of the contract. This includes contract documents and all information generated in the performance of the contract.

2.6 Responsibilities of the Ordering Activity

Subject to the ordering activity security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Identity Credential and Access Management (ICAM) services.

2.7 Independent Contractor

All Identity Credential and Access Management (ICAM) services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

2.8 Organizational Conflicts of Interest

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refer to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or

(ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

2.9 Invoices

The Contractor, upon completion of the work ordered, shall submit invoices for Identity Credential and Access Management (ICAM) services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

2.10 Resumes

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

2.11 Approval of Subcontracts

The ordering activity may require that the Contractor receive, from the ordering activity Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

2.12 Description of Identity Credential and Access Management (ICAM) Services and Pricing

3.0 Terms and Conditions Applicable to Highly Adaptive

Cybersecurity Services (HACS) (SIN 54151HACS)

54151HACS Includes a wide range of fields such as, the seven-step Risk Management Framework services, information assurance, virus detection, network management, situational awareness and incident response, secure web hosting, and backup, security services and, Security Operations Center (SOC) services. HACS vendors are cataloged under the 5 subcategories of High Value Asset Assessments; Risk and Vulnerability Assessments, Cyber Hunt, Incident Response, and Penetration Testing.

Vendor suitability for offering services through the Highly Adaptive Cybersecurity Services (HACS) SIN must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

• Federal Acquisition Regulation (FAR) Part 52.204-21

• OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of Personally Identifiable Information (PII)

• OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the High Value Asset Program

• 2017 Report to the President on Federal IT Modernization

• The Cybersecurity National Action Plan (CNAP)

• NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology Systems

• NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security)

• NIST SP 800-30 - Guide for Conducting Risk Assessments

• NIST SP 800-35 - Guide to Information Technology Security Services

• NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations: A Systems Life Cycle Approach for Security and Privacy

• NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View

• NIST SP 800-44 - Guidelines on Securing Public Web Servers

• NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

• NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

• NIST SP 800-61 - Computer Security Incident Handling Guide

• NIST SP 800-64 - Security Considerations in the System Development Life Cycle

• NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

• NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

Systems and Organizations

• NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

• NIST SP 800-160 - Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems

• NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and Organizations

2.1 SCOPE

a. The labor categories, prices, terms and conditions stated under Special Item Number 54151HACS Highly Adaptive Cybersecurity Services (HACS) apply exclusively to Highly Adaptive Cybersecurity Services within the scope of this Multiple Award Schedule (MAS).

b. Services under this SIN are limited to Highly Adaptive Cybersecurity Services only. Software and hardware products are under different Special Item Numbers on Multiple Award Schedule (MAS) (e.g.

511210, 33411), and may be quoted along with services to provide a total solution.

c. This SIN provides ordering activities with access to Highly Adaptive Cybersecurity services only.

d. Highly Adaptive Cybersecurity Services provided under this SIN shall comply with all Cybersecurity certifications and industry standards as applicable pertaining to the type of services as specified by ordering agency.

e. SCOPE:

54151HACS Highly Adaptive Cybersecurity Services (HACS) - SUBJECT TO COOPERATIVE PURCHASING - includes proactive and reactive cybersecurity services that improve the customer’s enterprise-level security posture.

The scope of this category includes proactive and reactive cybersecurity services that improve customer enterprise-level security posture. Services to identify and protect a customer's information resources, detect and respond to cybersecurity events or incidents, and recover capabilities or services impaired by any incidents that emerge. It encompasses a wide range of fields that include, but are not limited to, Risk Management Framework (RMF) services, information assurance (IA), virus detection, network management, situational awareness and incident response, secure web hosting, and backup and security services.

The seven-step RMF includes preparation, information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. RMF activities may also include Information Security Continuous Monitoring Assessment (ISCMA) which evaluate organization wide ISCM implementations, and also Federal Incident Response Evaluations (FIREs), which assess an organization’s incident management functions.

The scope of this category also includes Security Operations Center (SOC) services. The SOC scope includes services such as: 24x7x365 monitoring and analysis, traffic analysis, incident response and coordination, penetration testing, anti-virus management, intrusion detection and prevention, and information sharing.

HACS vendors are able to identify and protect a customer’s information resources, detect, and respond to cybersecurity events or incidents, and recover capabilities or services impaired by any incidents that emerge.

This contract consists of the following subcategories under SIN 54151HACS:

• High Value Asset (HVA) Assessments include Risk and Vulnerability Assessment (RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing. Security Architecture Review (SAR) evaluates a subset of the agency’s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems. SAR provides a holistic analysis of how an HVA’s individual security components integrate and operate, including how data is protected during operations. Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on but is not limited to the following security areas:

perimeter security, network security, endpoint security, application security, physical security, and data security.

• Risk and Vulnerability Assessment (RVA) assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing.

• Penetration Testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

• Incident Response services help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.

• Cyber Hunt activities respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunts start with the premise that threat actors known to target some organizations in a specific industry or with specific systems are likely to also target other organizations in the same industry or with the same systems.

f. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2.2 Order

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket Purchase Agreements, individual purchase orders, or task orders for ordering services under this contract.

Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

2.3 Performance of Services

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity. All Contracts will be fully funded.

b. The Contractor agrees to render services during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of Highly Adaptive Cybersecurity Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use the GSA City Pair Program for travel in support of any contracts. All travel will be agreed upon with the client prior to the Contractor’s travel.

2.4 Inspection of Services

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND CONDITIONS– COMMERCIAL ITEMS (Jan 2017) & (ALTERNATE I-Jan 2017) for Time-and-Materials and Labor-Hour orders placed under this contract.

2.5 Responsibilities of the Contractor

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (May 2014) Rights in Data – General, may apply.

The Contractor shall comply with contract clause (52.204-21) to the Federal Acquisition Regulation (FAR) for the basic safeguarding of contractor information systems that process, store, or transmit Federal data received by the contract in performance of the contract. This includes contract documents and all information generated in the performance of the contract.

2.6 Responsibilities of the Ordering Activity

Subject to the ordering activity security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Highly Adaptive Cybersecurity Services.

2.7 Independent Contractor

All Highly Adaptive Cybersecurity Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

2.8 Organizational Conflicts of Interest

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refer to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or

(ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

2.9 Invoices

The Contractor, upon completion of the work ordered, shall submit invoices for Highly Adaptive Cybersecurity Services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

2.10 Resumes

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

2.11 Approval of Subcontracts

The ordering activity may require that the Contractor receive, from the ordering activity Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

2.12 Description of Highly Adaptive Cybersecurity Services and Pricing

3.0 Labor Category Pricing

Highly Adaptive Cybersecurity Services (SIN 54151HACS) Information Technology Services (SIN 54151S) Identity, credentialing, and access management (541519ICAM)

(Pricing with IFF)

SIN Labor Category GSA PRICE including IFF 7/12/2025 –7/11/2026

541519ICAM Software Systems Engineer $162.10

541519ICAM Software Architect $162.10

541519ICAM Solutions Architect $147.36

541519ICAM Support Engineer $108.06

541519ICAM Senior Solutions Architect $147.36

54151HACS, 54151S Security Engineer $130.12

54151HACS, 54151S Software Developer $130.12

54151HACS, 54151S Sr. Software Developer $162.65

54151HACS, 54151S Security Consultant $125.78

54151HACS, 54151S Infrastructure Application and Database SME - Senior $162.09

54151HACS, 54151S Enterprise Architect $162.09

Annual fixed escalation rate of 2.5%

Service Contract Labor Standards: Not applicable.

4.0 Labor Category Descriptions

Labor Category Title Labor Category Description Minimum

Education Minimum Years of Experience

Software Systems Engineer

Job Description:

The Software Systems Engineer is responsible for supporting the design, integration, and operational stability of enterprise-scale software systems, with a focus on secure identity and access capabilities. This role combines systems engineering expertise with software development knowledge to ensure resilient, scalable solutions within complex IT environments such as those found in large organizations.

Key Responsibilities:

• Provide engineering support across all layers of enterprise software systems, with a focus on Identity and Access Management (IAM) and Privileged Access Management (PAM) solutions.

• Collaborate with operational teams to resolve technical issues, support incident response, and ensure systems meet availability and performance requirements.

• Assist in the integration, testing, and deployment of secure, three-tier software architectures supporting identity platforms (e.g., SailPoint, CyberArk).

• Coordinate with vendors and infrastructure teams to ensure compatibility and compliance with enterprise security frameworks and technical standards.

• Translate business and security requirements into system configurations, automated workflows, and software enhancements.

• Support migration and release activities, including the movement of tested features from development to staging and production environments.

• Document technical specifications, deployment procedures, and system configurations to support long-term maintainability.

Bachelors 5

Software Architect

Job Description:

The Software Architect serves as the lead technical expert responsible for guiding the design, development, and integration of enterprise-grade software solutions. This role provides end-to-end architectural leadership across critical systems, ensuring alignment with client objectives, security requirements, and scalability needs—particularly in support of large-scale programs

Key Responsibilities:

• Lead architectural planning and provide technical direction for complex software systems across all layers of the enterprise stack.

• Work closely with operational and engineering teams to assess system needs, resolve performance issues, and address urgent technical challenges.

• Maintain active engagement with software vendors and third-party providers to ensure integration compatibility and long-term solution viability.

• Provide strategic vision and architectural guidance to support the development and maintenance of highly available, secure, and scalable three-tier systems.

• Communicate architectural decisions and technical concepts clearly to diverse audiences, including client stakeholders, infrastructure teams, and external partners.

• Collaborate with business units to understand evolving mission needs and translate them into scalable software capabilities that address current and emerging risks.

Bachelors 7

Solutions

Job Description:

The Solution Architect serves as the technical lead for all Identity and Access Management (IAM) and Privileged Access Management (PAM) systems, providing expert-level guidance and oversight across the full lifecycle of these solutions. This role is responsible for the overall architecture, design, and performance of highly available, enterprise-scale IAM/PAM platforms.

Key Responsibilities:

• Serve as the primary technical authority for IAM/PAM systems

• Provide strategic direction and hands-on support in collaboration with client operational teams for day-to-day operations and emergency response scenarios.

• Maintain strong relationships with solution vendors to stay current on product capabilities and roadmap updates.

• Deliver architectural guidance and technical options to stakeholders across IT, security, and business units.

• Design and maintain three-tiered, scalable, and secure IAM/PAM solutions in complex enterprise environments.

• Communicate complex technical concepts clearly and appropriately to a variety of audiences, including executives, system integrators, and infrastructure partners.

• Collaborate with business stakeholders to assess risk, understand evolving threat landscapes, and align business requirements with IAM/PAM capabilities.

Bachelors 7

Support Engineer Job Description:

The Support Engineer is responsible for providing responsive, end-to-end technical support to clients, ensuring system stability and issue resolution throughout the support lifecycle. This role supports enterprise environments by managing service requests, coordinating communication, and assisting with enhancements, patches, and environment migrations. For example, in support of Hofstra University, this role ensured consistent and proactive engagement with client IT teams.

Key Responsibilities:

• Receive and respond to client support requests, ensuring timely issue tracking and resolution.

• Maintain ongoing communication with the client throughout the support lifecycle— from request initiation through resolution and approved closure.

• Provide weekly status reports detailing progress on critical issues, outstanding findings, and action items.

• Escalate complex or unresolved issues to vendors (e.g., Oracle) when appropriate, and follow through until resolution.

• Assist with the development, integration, and testing of approved system enhancements, patch sets, and fix packs.

• Support environment migration efforts by assisting with the promotion of fully tested changes from Development to Staging and Production environments.

• Ensure documentation, testing protocols, and migration steps are followed in alignment with client expectations and internal standards.

Bachelors 2

Senior Solutions

Job Description:

The Senior Solutions Architect serves as the lead technical authority for Identity and Access Management (IAM) and Privileged Access Management (PAM) solutions, offering strategic and hands-on leadership across the full system lifecycle. This role is critical in designing, enhancing, and supporting secure, enterprise-scale architectures that serve large clients.

Key Responsibilities:

• Provide technical leadership and architectural oversight for IAM and PAM systems, ensuring alignment with enterprise security and business objectives.

• Collaborate directly with client operational teams to deliver expert guidance on complex technical issues, including real-time problem resolution and emergency support.

• Maintain close working relationships with solution vendors (e.g., SailPoint, CyberArk) to stay current on product capabilities and integrate emerging technologies into the enterprise environment.

• Design and support robust, highly available, three-tier identity solutions capable of serving large-scale, multi-system environments.

• Communicate solution architecture, technical concepts, and implementation details clearly…