MAS - Vancepoint LLC - 47QTCA22D0059

GENERAL SERVICES ADMINISTRATION

Federal Supply Service

Authorized Federal Supply Schedule Price List

On-line access to contract ordering information, terms and conditions, up-to- date pricing, and the option to create an electronic delivery order are available through GSA Advantage!, a menu-driven database system.

The INTERNET address for GSA Advantage! is: GSAAdvantage.gov.

Multiple Award Schedule

FSC GROUP: DA01 CONTRACT # 47QTCA22D0059

For more information on ordering from Federal Supply Schedules go to the GSA Schedules page at GSA.gov.

CONTRACT PERIOD: MARCH 2ND 2022 - MARCH 1ST 2027

CONTRACTOR: VANCEPOINT, LLC

4401 4th St N Apt 356

Arlington, VA 22203

PHONE: (413) 207-1439

WEBSITE: https://www.vancepoint.com

CONTACT: Mr. Alec Squaire

Email: asquaire@vancepoint.com

BUSINESS SIZE: Small

CERTIFICATIONS: SDB

Price list current as of March 2nd 2022 http://www.vancepoint.com/ http://www.vancepoint.com/ mailto:asquaire@vancepoint.com

CUSTOMER INFORMATION

1a. Table of awarded special item number(s) with appropriate cross-reference to item descriptions and awarded price(s).

SINs SIN TITLE

54151S Information Technology Professional Services

518210C Cloud and Cloud-Related IT Professional Services

54151HACS Highly Adaptive Cybersecurity Services (HACS

OLM Order-Level Materials

1b. Identification of the lowest priced model number and lowest unit price for that model for each special item number awarded in the contract. This price is the Government price based on a unit of one, exclusive of any quantity/dollar volume, prompt payment, or any other concession affecting price. Those contracts that have unit prices based on the geographic location of the customer, should show the range of the lowest price, and cite the areas to which the prices apply.

SIN 54151S Information Technology Professional Services

54151S IT Professional Services and/or labor categories for database planning and design; systems analysis, integration, and design; programming, conversion and implementation support; network services, data/records management, and testing.

NOTE: Subject to Cooperative Purchasing

Instructions:

1. Specific Instructions for SIN 54151S - Information Technology Professional Services:

*All services shall be billed in arrears in accordance with 31 U.S.C. 3324.

SIN 518210C Cloud Computing and Cloud Related IT Professional Services

518210C Includes commercially available cloud computing services such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) and emerging cloud computing services. IT professional services that are focused on providing the types of services that support the Government's adoption of, migration to, or governance/management of cloud computing. Specific cloud related IT professional labor categories and/or fixed-price professional services solutions (e.g., migration services) that support activities associated with assessing cloud solutions, refactoring workloads for cloud solutions, migrating legacy or other systems to cloud solutions, providing management/governance of cloud solutions, DevOps, developing cloud native applications, or other cloud oriented activities are within scope of this SIN.

NOTE: Subject to Cooperative Purchasing

Instructions:

Additional SIN Description: This SIN provides access to cloud (e.g., IaaS, PaaS, SaaS) computing services across public, community, and hybrid deployment models. Cloud computing services shall comply with National Institute of Standards and Technology (NIST) Definition of Cloud Computing Essential Characteristics (NIST SP 800-145).

Cloud computing that does not meet all NIST essential characteristics are outside the scope of this SIN and shall be assigned to other SINs, where applicable.

Cloud related IT professional labor categories are within scope of this SIN. Cloud related IT professional labor categories are not subject to adherence to the NIST definition of cloud computing; therefore, no technical response is required for a labor proposal. Non-professional labor categories subject to Service Contract Labor Standards

(SCLS) (e.g., IT help desk support) that are incidental to and used solely to support specific Cloud related IT professional labor categories and/or fixed-price professional services solutions must be offered under a different

SIN that specifically covers the proposed services.

Ancillary products and services are not within scope of this SIN. Any items that are not within the scope of this SIN must be offered under a SIN that specifically covers the proposed services.

The following are out of scope for this SIN: cloud “token,” “gift card,” “credit,” or other similar types of prepaid offerings:

1.) Cloud computing services (e.g., IaaS, PaaS, SaaS) are sometimes offered commercially as a cloud “token,” “gift card,” “credit,” or require purchase of a prepaid offering; these are out of scope for this SIN. The pricing model for these items do not accurately represent the stock-keeping units (SKU) that are awarded at the task-order level.

Therefore, non submission of pricing of underlying IaaS, PaaS, SaaS SKUs is not allowed.

2.) Credits for cloud computing services (e.g., IaaS, PaaS, SaaS) that are paid for in advance and spent or used at a later time are commonly termed commercially as a cloud “token,” “gift card,” or “credit”, and are out of scope for

SIN 518210C. Cloud computing services (e.g., IaaS, PaaS, SaaS) must be paid for in arrears in accordance with 31

U.S.C. 3324.

3.) Also out of scope is any payment for cloud computing services which carry a risk to the Government of a “use or lose” situation where a Government cloud account may forfeit unexpended credits/deposits towards future cloud computing services charges at the end of a vendor-defined period (e.g., 1, 2 or 3 years). Therefore, pre-payment of products or services prior to delivery of SKUs is not allowed. Payment for these SKUs must be in arrears.

Physical hardware, non-cloud software per the NIST definition, and other artifacts acquired to support the physical construction of a private or other cloud are not within the scope of this SIN.

1) Specific Instructions for SIN 518210C – Cloud Computing and Cloud Related IT Professional Services

a) All offerings must be billed as follows:

i) Cloud computing services (e.g., IaaS, PaaS, SaaS) must adhere to the “pay as you go” pricing model and must be billed in arrears in accordance with 31 U.S.C. 3324.

ii) Cloud related IT professional services, specific cloud labor categories and/or fixed-price professional services solutions must also be billed in arrears in accordance with 31 U.S.C. 3324.

b) Offerors shall follow instructions and guidance for cloud computing services available at http://www.gsa.gov/mascategoryrequirements

c) Offerors may propose:

i) Cloud computing services only (e.g., IaaS, PaaS, SaaS);

ii) Cloud related IT professional services and/or fixed-price professional services solutions that are not subject to NIST standards only; or

iii) Cloud computing services (e.g., IaaS, PaaS, SaaS) (subject to NIST standards) and cloud related IT professional services and/or fixed-price professional services solutions (not subject to NIST standards).

iv) The offeror must state which cloud computing service model(s), if any, is/are being proposed (e.g., IaaS, PaaS, SaaS).

v) The offeror must state which cloud computing deployment model(s), if any, is/are being proposed (e.g., public, community, and hybrid).

d) Acceptance Testing: Acceptance testing shall be performed of the systems for ordering activity approval in accordance with the approved test procedures.

e) Training

i) If training is provided in accordance with standard commercial practices, the offeror shall provide normal commercial installation, operation, maintenance, and engineering interface training on the system.

ii) If there are separate training charges, they should be included in the GSA Price List (I-FSS-600

CONTRACT PRICE LISTS (OCT 2016).

f) Information Assurance/Security Requirements: Offerors shall meet information assurance/security requirements in accordance with the ordering activity requirements.

g) Reporting: Offerors shall provide to the ordering activity any general reporting capabilities available to verify performance, cost and availability. In accordance with commercial standard practice, the offeror may furnish the ordering activity with a monthly summary report.

h) Cloud related IT professional services may be listed on SIN 54151S - Information Technology Professional

Services. The cloud related IT professional services on this SIN (518210C) shall be cloud specific titles and descriptions. At a minimum, the word “cloud” shall appear both in the title and the description of each labor category or fixed-price professional services solutions proposed for this SIN. The relevant past performance projects must demonstrate that the cloud related IT professional services were utilized in the IaaS, PaaS, and/or

SaaS environment. NOTE: Identical labor categories cannot be on both SINs 54151S and 518210C. It is recommended that cloud related IT professional services and/or fixed-price professional services solutions that are not subject to NIST standards should be offered under SIN 518210C.

i) Offerors may optionally select a single service model that best fits a proposed cloud computing offering.

Only one service model may be selected per each proposed cloud computing offering. Offerors may elect to submit multiple cloud computing offerings, each with its own single service model.

j) Deployment model selection within this SIN is optional for any individual cloud computing offering.

Offerings may be included without a deployment model selection so long as they comply with all the essential characteristics of cloud computing as outlined by NIST SP 800-145. The three NIST deployment models within the scope of this SIN are: Public, Community, and Hybrid.

k) All current pricing requirements in provision SCP-FSS-001 apply. At the current time, there is no provision for reducing or eliminating standard price list posting requirements to accommodate rapid cloud price fluctuations.

l) All pricing models for cloud computing services must have the core capability to meet the NIST Essential

Cloud Characteristics, particularly with respect to on-demand self-service, while allowing alternate variations at the task order level at agency discretion, pursuant to the guidance on NIST Essential Characteristics.

m) Evaluation factors for cloud related IT professional services, specific cloud labor categories and/or fixed-price professional services solutions are found within this same document under Section II Instructions for all IT

Offerors under 6) Relevant Project Experience Evaluation.

2) Specific Evaluation Factor for Cloud Computing Services Adherence to the NIST Essential Cloud

Characteristics per NIST SP 800-145.

Within a two-page limitation for each cloud computing service (e.g., IaaS, PaaS, SaaS) submitted, provide a description of how the cloud computing service meets each of the five essential cloud computing characteristics as defined in National Institute of Standards and Technology (NIST) Special Publication 800-145 and subsequent versions of this publication. This standard specifies the definition of cloud computing for use by Federal agencies.

Each cloud computing service must be capable of satisfying each of the five NIST essential characteristics as follows:

• On-demand self-service

• Broad network access

• Resource pooling

• Rapid elasticity

• Measured service cloud (Pay per use, or pay as you go)

Refer to 518210C. Specific Information for Offerors available at http://www.gsa.gov/mascategoryrequirements for guidance on meeting the NIST essential characteristics. For the purposes of the cloud computing and cloud related

IT professional services SIN, meeting the NIST essential characteristics is concerned primarily with whether the underlying capability of the commercial service is available, and whether or not an ordering activity actually requests or implements the capability.

SIN 54151HACS Highly Adaptive Cybersecurity Services (HACS)

54151HACS Includes a wide range of fields such as, the seven-step Risk Management Framework services, information assurance, virus detection, network management, situational awareness and incident response, secure web hosting, and backup, security services and, Security Operations Center (SOC) services. HACS vendors are cataloged under the 5 subcategories of High Value Asset Assessments; Risk and Vulnerability Assessments, Cyber

Hunt, Incident Response, and Penetration Testing.

NOTE: Subject to Cooperative Purchasing

Instructions:

Additional SIN Description: Includes proactive and reactive cybersecurity services that improve customer enterprise-level security posture. Services to identify and protect a customer's information resources, detect and respond to cybersecurity events or incidents, and recover capabilities or services impaired by any incidents that emerge.

It encompasses a wide range of fields that include, but are not limited to, Risk Management Framework (RMF) services, information assurance (IA), virus detection, network management, situational awareness and incident response, secure web hosting, and backup and security services.

The seven-step RMF includes preparation, information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. RMF activities may also include Information Security Continuous Monitoring Assessment (ISCMA), which evaluate organization-wide

ISCM implementations, and also Federal Incident Response Evaluations (FIREs), which assess an organization's incident management functions.

It also includes Security Operations Center (SOC) services. The SOC scope includes services such as: 24x7x365 monitoring and analysis, traffic analysis, incident response and coordination, penetration testing, anti-virus management, intrusion detection and prevention, and information sharing.

1. Specific Instructions for SIN 54151HACS - Highly Adaptive Cybersecurity Services (HACS)

a. Offerors may request to be placed in the following subcategories.

i. High Value Asset (HVA) Assessments include Risk and Vulnerability Assessment (RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating

System Security Assessment (OSSA), Database Assessment, and Penetration Testing. Security Architecture Review

(SAR) evaluates a subset of the agency s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems. SAR provides a holistic analysis of how an HVA s individual security components integrate and operate, including how data is protected during operations. Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on, but is not limited to the following security areas: perimeter security, network security, endpoint security, application security, physical security, and data security.

ii. Risk and Vulnerability Assessment (RVA) assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the

RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and

Penetration Testing.

iii. Penetration Testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

iv. Incident Response services help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.

v. Cyber Hunt activities respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunts start with the premise that threat actors known to target some organizations in a specific industry or with specific systems are likely to also target other organizations in the same industry or with the same systems.

b. Services offered SIN 54151HACS shall be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

o Federal Acquisition Regulation (FAR) Part 52.204-21 o OMB Memorandum M-17-12 - Preparing for and Responding to a Breach of Personally Identifiable

Information (PII) o OMB Memorandum M- 19-03 - Strengthening the Cybersecurity of Federal Agencies by enhancing the

High Value Asset Program o 2017 Report to the President on Federal IT Modernization

• The Cybersecurity National Action Plan (CNAP) o NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology

Systems o NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving

Security) o NIST SP 800-30 - Guide for Conducting Risk Assessments o NIST SP 800-35 - Guide to Information Technology Security Services o NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations: A Systems

Life Cycle Approach for Security and Privacy o NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System

View o NIST SP 800-44 - Guidelines on Securing Public Web Servers o NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks o NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations o NIST SP 800-61 - Computer Security Incident Handling Guide o NIST SP 800-64 - Security Considerations in the System Development Life Cycle o NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security o NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response o NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment o NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information Systems o NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations o NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs) o NIST SP 800-160 - Systems Security Engineering: Considerations for a Multidisciplinary Approach in the

Engineering of Trustworthy Secure Systems o NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and

Organizations.

c. All professional labor categories under SIN 54151S Information Technology Professional Services may remain there, unless the labor categories are specific to SIN 54151HACS.

2. Oral Technical Evaluation for SIN 54151HACS - Highly Adaptive Cybersecurity Services (HACS)

a. Unless otherwise specified, the offeror shall participate in an oral technical evaluation that will be conducted by a Technical Evaluation Board (TEB). The oral technical evaluation will be held at the unclassified level and will be scheduled by the TEB. The oral technical evaluation will be used to assess the offeror's capability to successfully perform the services within the scope of each subcategory as set forth in this solicitation, excepting those service components awarded through the submission of the Service Self-Attestation. The Self-Attestation form is available at gsa.gov/hacs.

An offeror may only be awarded SIN 54151HACS upon successful completion of the Highly Adaptive

Cybersecurity Services oral technical evaluation. If the offeror elects to be cataloged under the "Cyber Hunt" and/or

"Incident Response" subcategories, additional questions related to those areas will be asked during the HACS Oral

Technical Evaluation.

i. ORAL TECHNICAL EVALUATION CONSTRAINTS: The offeror shall identify up to five key personnel, by name and association with the offeror, who will field questions during the oral technical evaluation. The HACS

SIN consists of 5 subcategories. The base HACS Oral Technical Evaluation consists of questions related to the 3 subcategories of, High Value Asset Assessments, Risk and Vulnerability Assessments and Penetration Testing. One

(1) hour and 40 minutes is allotted for the base HACS Oral Technical Evaluation. The evaluation will be stopped precisely after 1 hour and 40 minutes. Should the offeror elect to be considered for the additional subcategories of

Incident Response and Cyber Hunt, an additional 10 minutes will be allotted for each of those subcategories. The total base evaluation session is expected to last up to 1 hour and 40 minutes, depending on the number of subcategories the offeror is proposing. The TEB Chairperson will be responsible for ensuring the schedule is met and that all offerors are given the same opportunity to present and answer questions.

ii. ORAL TECHNICAL EVALUATION SCHEDULING: The TEB will contact the offeror's authorized negotiator or the signatory of the SF 1449 via email to schedule the oral technical evaluation. Evaluation time slots will be assigned on a first-come-first-served basis. The Government reserves the right to reschedule any offeror's oral technical evaluation at its sole discretion. The oral technical evaluation will be held at facilities designated by the TEB. The exact location, seating capacity, and any other relevant information will be provided when the evaluations are scheduled. The Government may also make accommodations for vendors to participate in the oral evaluations virtually.

iii. PROHIBITION OF ELECTRONIC RECORDING OF THE ORAL TECHNICAL EVALUATION: The offeror may not record or transmit any of the oral evaluation process. All offeror's electronic devices shall be removed from the room during the evaluation. The offeror is permitted to have a timer in the room during the evaluation, provided by the TEB.

iv. RESUBMISSION RESTRICTIONS FOR UNSUCCESSFUL VENDORS UNDER THIS EVALUATION

FACTOR: The TEB will afford the offeror multiple opportunities to achieve the "pass" criteria under this evaluation factor through "clarification" questioning, during the Oral Technical Evaluation. Any offeror whom the

TEB has found to have not passed under this evaluation factor shall be failed and shall be ineligible to re-submit under the SIN to participate in this evaluation factor for a period of six (6) months following the date of failure.

v. HIGH VALUE ASSET (HVA) ASSESSMENTS SUBCATEGORY PLACEMENT: Any offeror previously awarded all of the following four SINs: 132-45A Penetration Testing, 132-45B Incident Response, 132-45C Cyber

Hunt, and 132-45D Risk and Vulnerability Assessment, shall not be subject to a Highly Adaptive Cybersecurity

Services oral technical evaluation, so long as they provide in the modification package to the GSA contracting officer a Service Self-Attestation acknowledging their ability to perform Security Architecture Review (SAR) and

Systems Security Engineering (SSE) services in their entirety. The Self-Attestation form is available at gsa.gov/hacs.

b. Oral Technical Evaluation Procedures: The offeror will be evaluated on their knowledge of the proposed services. The oral technical evaluation will require the offeror to respond to a specific scenario and general questions to assess the offeror's expertise. The competencies, criteria and evaluation minimums for the questions are below: All new offerors and modifications must participate in and PASS the HACS Oral Technical Evaluation.

The Oral Technical Evaluation will include, at a minimum, questions on Risk and Vulnerability Assessment

(RVA), Security Architecture Review (SAR), Systems Security Engineering (SSE), and Penetration Testing. At the time of submission, all new offerors and modifications can also elect to be cataloged in one or both of the additional subcategories of Cyber Hunt or Incident Response (IR). Should this election be taken, additional questions related to these subcategories will be included in their HACS evaluation and these additional subcategory topics must be passed as well.

c. Oral Technical Evaluation Criteria: The offeror's responses to the government's questions during the oral technical evaluation session shall be used to determine whether the offeror has the requisite experience and expertise to perform tasks expected to be performed within the scope of the SIN. The oral technical proposal will be evaluated and rated on a pass/fail basis. The rating definitions provided below will be used for the evaluation of the offeror's responses to questions during the oral evaluation.

d. SIN Subgroups: Upon completion of the oral technical evaluation for both offers and modifications, the government will determine which of the following 5 SIN subgroups apply:

1. High value Asset (HVA) Assessments

2. Risk and Vulnerability Assessment (RVA)

3. Cyber Hunt

4. Incident Response

5. Penetration Testing

Following notification that they are eligible for one or more of the 5 SIN subgroups, awarded contractors may select the corresponding subgroups by following the instructions below:

1. Login to eBuy

2. From the top menu, select "Profile"

3. Click "Modify Subgroups"

4. Select the applicable subgroups according to the instructions

All contractor selections will be monitored by GSA for compliance and action will be taken against your contract if you select Subgroups that have not been awarded under your contract.

Note: All services shall be billed in arrears in accordance with 31 U.S.C. 3324.

TECHNICAL RATINGS

Rating Definition

Pass The proposal clearly meets the minimum requirements of the solicitation.

Fail The proposal does not clearly meet the minimum requirements of the solicitation.

OFFERED PRICING

SIN POSITION Jan

2022–

Jan

Jan

2023 –

Jan

Jan

2024–

Jan

Jan

2025–

Jan

Jan

2026 –

Jan

518210C Cloud Solutions Engineer - Mid $110.08 $112.55 $115.08 $117.67 $120.32

518210C Cloud Solutions Engineer - Senior $138.79 $141.91 $145.11 $148.37 $151.71

54151HACS Cyber Security Consultant - Mid $119.65 $122.34 $125.09 $127.91 $130.78

54151HACS Cyber Security Consultant - Senior $143.58 $146.81 $150.11 $153.49 $156.94

54151HACS Cyber Security Consultant - Principal $155.06 $158.55 $162.12 $165.77 $169.50

54151HACS Cyber Security Engineer - Mid $110.08 $112.55 $115.08 $117.67 $120.32

54151HACS Cyber Security Engineer - Senior $138.79 $141.91 $145.11 $148.37 $151.71

54151HACS Cyber Security Engineer - Principal $187.41 $191.62 $195.93 $200.34 $204.85

54151HACS Cyber Security Control Assessor II $133.05 $136.04 $139.10 $142.23 $145.43

54151HACS Cyber Security Control Assessor III $147.00 $150.31 $153.69 $157.15 $160.69

54151HACS Cyber Security Information Assurance Engineer - Principal $167.51 $171.28 $175.13 $179.07 $183.10

54151S SCA IT Test Engineer I $110.08 $112.55 $115.08 $117.67 $120.32

54151S SCA IT Test Engineer II $134.96 $138.00 $141.10 $144.28 $147.52

54151S SCA IT Test Engineer III $147.00 $150.31 $153.69 $157.15 $160.69

Service Contract Labor Standards: The Service Contract Labor Standards (SCLS), formerly known as the Service

Contract Act (SCA), is applicable to this contract as it applies to the entire Multiple Award Schedule (MAS) and all services provided. While no specific labor categories have been identified as being subject to SCLS/SCA due to exemptions for professional employees (FAR 22.1101, 22.1102 and 29 CRF 541.300), this contract still maintains the provisions and protections for SCLS/SCA eligible labor categories. If and / or when the contractor adds SCLS/SCA labor categories to the contract through the modification process, the contractor must inform the Contracting Officer and establish a SCLS/SCA matrix identifying the GSA labor category titles, the occupational code, SCLS/SCA labor category titles and the applicable WD number. Failure to do so may result in cancellation of the contract.

1c. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles, experience, functional responsibility and education for those types of employees or subcontractors who will perform services shall be provided. If hourly rates are not applicable, indicate “Not applicable” for this item.

LABOR CATEGORY DESCRIPTIONS

Labor Category: Cloud Solutions Engineer - Mid

Minimum Experience: 5 Years of related Technical Experience Functional Responsibility: Leads the creation, development, test, and management of production cloud environments providing high availability, scalable, fault-tolerant

PaaS/SaaS/IaaS platforms. Responsible for implementing continuous integration and deployment of solutioning in accordance with governance and business objectives. Prepares compute and storage requirements in support of optimized cloud solutions.

Provides direct support for the planning, designing, and developing infrastructure in support of cloud-based applications. Manages cloud environments in accordance with security guidelines.

Can complete more complex tasks with minimal supervision.

Minimum Education: Bachelor’s Degree in Computer Science, Information

Systems, Business or equivalent field

Labor Category: Cloud Solutions Engineer - Senior

Minimum Experience: 10 Years of related Technical Experience Functional Responsibility: Leads the creation, development, test, and management of production cloud environments providing high availability, scalable, fault-tolerant

PaaS/SaaS/IaaS platforms. Responsible for implementing continuous integration and deployment of solutioning in accordance with governance and business objectives. Prepares compute and storage requirements in support of optimized cloud solutions.

Provides direct support for the planning, designing, and developing infrastructure in support of cloud-based applications. Manages cloud environments in accordance with security guidelines.

Can complete all tasks with no supervision required.

May supervise junior personnel.

Labor Category: Cyber Security Consultant - Mid

Functional Responsibility: Applies extensive knowledge of a variety of the information assurance field's concepts, practices, and procedures to ensure the secure integration and operations of all computer enclave systems. Works independently to evaluate and solve complex information assurance related problems quickly and completely. Supports, monitors, tests, and troubleshoots hardware and software information assurance problems.

Develops system-wide information security requirements based upon the analysis of user, policy, regulatory, and resource demands for complex network and enclave systems. Can complete more complex tasks with minimal supervision.

Labor Category: Cyber Security Consultant - Senior

Functional Responsibility: Applies extensive knowledge of a variety of the information assurance field's concepts, practices, and procedures to ensure the secure integration and operations of all computer enclave systems. Works independently to evaluate and solve complex information assurance related problems quickly and completely. Supports, monitors, tests, and troubleshoots hardware and software information assurance problems.

Develops system-wide information security requirements based upon the analysis of user, policy, regulatory, and resource demands for complex network and enclave systems. Can complete all tasks with no supervision required. May supervise junior personnel.

Labor Category: Cyber Security Consultant - Principal

Minimum Experience: 15 Years of related Technical Experience Functional Responsibility: Applies extensive knowledge of a variety of the information assurance field's concepts, practices, and procedures to ensure the secure integration and operations of all computer enclave systems. Works independently to evaluate and solve complex information assurance related problems quickly and completely. Supports, monitors, tests, and troubleshoots hardware and software information assurance problems.

Develops system-wide information security requirements based upon the analysis of user, policy, regulatory, and resource demands for complex network and enclave systems. Can complete all tasks with no supervision required. Shall supervise junior personnel.

Labor Category: Cyber Security Engineer - Mid

Functional Responsibility: Analyzes general information assurance-related technical problems and provides basic engineering and technical support in solving these problems. Designs, develops, engineers, and implements solutions that meet network security requirements. Performs vulnerability/risk analyses of computer systems and applications during all phases of the system development life cycle. Can complete more complex tasks with minimal supervision.

Labor Category: Cyber Security Engineer - Senior

Functional Responsibility: Analyzes general information assurance-related technical problems and provides basic engineering and technical support in solving these problems. Designs, develops, engineers, and implements solutions that meet network security requirements. Performs vulnerability/risk analyses of computer systems and applications during all phases of the system development life cycle. Can complete all tasks with no supervision required. May supervise junior personnel.

Labor Category: Cyber Security Engineer - Principal

Minimum Experience: 15 Years of related Technical Experience Functional Responsibility: Analyzes general information assurance-related technical problems and provides basic engineering and technical support in solving these problems. Designs, develops, engineers, and implements solutions that meet network security requirements. Performs vulnerability/risk analyses of computer systems and applications during all phases of the system development life cycle. Can complete all tasks with no supervision required. Shall supervise junior personnel.

Labor Category: Cyber Security Control Assessor II

Functional Responsibility: Technically assesses both major applications and general support system security configurations and implementation. Interfaces with federal employees and contractors to perform the security assessment activities.

Responsible for assisting in the presentation of the vulnerability findings to the client. Analyzes results from vulnerability scanning tools. Interfaces with the clients related to the overall security control assessment program and all security control assessment activities.

Can complete more complex tasks with minimal supervision.

Labor Category: Cyber Security Control Assessor III

Functional Responsibility: Technically assesses both major applications and general support system security configurations and implementation. Interfaces with federal employees and contractors to perform the security assessment activities.

Responsible for assisting in the presentation of the vulnerability findings to the client. Analyzes results from vulnerability scanning tools. Interfaces with the clients related to the overall security control assessment program and all security control assessment activities.

Can complete more complex tasks with minimal supervision. May supervise junior personnel.

Labor Category: Cyber Security Information Assurance Engineer –

Principal

Minimum Experience: 15 Years of related Technical Experience Functional Responsibility: Responsible for technical information assurance engineering efforts which may include: network/server scanning, patching, mitigation, assessment, authorization and compliance. Requires comprehension of FISMA, RMF, and NIST-800 SPs.

May be responsible for both local and remote systems.

Performs information systems engineering analysis for testing, assessing, evaluating, integrating, and enforcing requirements of Cybersecurity/IA products and tools to coordinate assessment and acquisition.

Duties may include assessment and evaluation of system architectures, vendor descriptions and technical application guides; interfacing with testing laboratories;

and reviewing solutions to ensure compliance with existing and emerging policies. Can complete all tasks with no supervision required. Shall supervise junior personnel.

Minimum Education: Bachelor’s Degree in Computer Science, Information Systems, Business or equivalent field

Labor Category: SCA IT Test Engineer I

Minimum Experience: 3 Years of related Technical Experience Functional Responsibility: Subject matter expert providing testing IT expertise for support of user requirements of complex to highly complex software/hardware applications. Directs and/or participates in all phases of assessments and software/hardware development with emphasis on analysis of user requirements, test design and test tools selection. Ensures that test design and documentation support all applicable client, agency or industry standards time lines and budgets.

Ensures that testing conclusions and recommendations are fully supported by test results, and project managers are fully informed of testing status and application deviations from documented user requirements. Can perform basic tasks under general supervision.

Labor Category: SCA IT Test Engineer II

Functional Responsibility: Subject matter expert providing testing IT expertise for support of user requirements of complex to highly complex software/hardware applications. Directs and/or participates in all phases of assessments and software/hardware development with emphasis on analysis of user requirements, test design and test tools selection. Ensures that test design and documentation support all applicable client, agency or industry standards time lines and budgets.

Ensures that testing conclusions and recommendations are fully supported by test results, and project managers are fully informed of testing status and application deviations from documented user requirements. Can perform more complex tasks under minimal supervision.

Labor Category: SCA IT Test Engineer II

Functional Responsibility: Subject matter expert providing testing IT expertise for support of user requirements of complex to highly complex software/hardware applications. Directs and/or participates in all phases of assessments and software/hardware development with emphasis on analysis of user requirements, test design and test tools selection. Ensures that test design and documentation support all applicable client, agency or industry standards time lines and budgets.

Ensures that testing conclusions and recommendations are fully supported by test results, and project managers are fully informed of testing status and application deviations from documented user requirements. Can perform more complex tasks under minimal supervision.

Minimum Education: Bachelor’s Degree in Computer Science, Information

Systems, Business or equivalent field

Labor Category:

SCA IT Test Engineer III

Minimum Experience: 10 Years of related Technical Experience Functional Responsibility: Subject matter expert providing testing IT expertise for support of user requirements of complex to highly complex software/hardware applications. Directs and/or participates in all phases of assessments and software/hardware development with emphasis on analysis of user requirements, test design and test tools selection. Ensures that test design and documentation support all applicable client, agency or industry standards time lines and budgets.

Ensures that testing conclusions and recommendations are fully supported by test results, and project managers are fully informed of testing status and application deviations from documented user requirements. Can perform all tasks with no supervision required.

SUBSTITUTION OF EDUCATION/EXPERIENCE

Education and experience may be substituted for each other. Each year of relevant experience may be substituted for 1 year of education, and vice versa. In addition, each year of vocational technical training completed may be substituted for experience or education on a one-for-one basis. Also, certifications and professional licenses may be substituted for education or experience based on approval from the ordering activity.

Degree Relevant Experience Equivalence*

Bachelors • HS Diploma + 4 years additional experience

• Associates Degree + 2 years additional experience

2. Maximum Order: $500,000

3. Minimum Order: $100.00

4. Geographic Coverage (Delivery Area): Worldwide

5. Point(s) of production: Same as company address

6. Discount from list prices: Federal Government Net Prices Prices listed are net. Discounts have been deducted and the industrial funding fee has been added,

7. Quantity Discounts: 1% discount for orders greater than or equal to $500,000

8. Prompt payment terms. Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions. 1.5% Net 15, Net 30.

9. Foreign Items: None

10a.Time of delivery. Contact Contractor

10b.Expedited Delivery. Contact Contractor

10c.Overnight and 2-day Delivery: Contact Contractor

10d Urgent Requirements: Contact Contractor

11. F.O.B. Point(s): Destination

12a.Ordering Address: Contractor Address

12b.Ordering procedures: For supplies and services, the ordering procedures, information on Blanket

Purchase Agreements (BPA’s) are found in Federal Acquisition Regulation (FAR) 8.405-3.

13. Payment address(es): Contractor Address

14. Warranty provision. Standard 1 Year Warranty

15. Export packing charges, if applicable. N/A

16. Terms and conditions of rental, maintenance, and repair (if applicable) N/A

17. Terms and conditions of installation (if applicable). N/A

18a.Terms and conditions of repair parts indicating date of parts price lists and any discounts from list prices

(if applicable). N/A

18b.Terms and conditions for any other services (if applicable) N/A

19. List of service and distribution points (if applicable). Contractor Address

20. List of participating dealers (if applicab1e). N/A

21. Preventive maintenance (if applicable). N/A

22a.Special attributes such as environmental attributes (e.g., recycled content, energy efficiency, and/or reduced pollutants) N/A

22b.If applicable, indicate that Section 508 compliance information is available on Electronic and

Information Technology (EIT) supplies and services and show where full details can be found (e.g.

contractor website or other location.) The EIT standards can he found at www.Section508.gov/. N/A

23. Unique Entity Identifier (UEI) Number: F96XALS7LDZ1

24. Notification regarding registration in System for Award Management (SAM) database. Contractor registered and active in SAM. Registration is valid through Sep 30, 2022.

http://www.section508.gov/