MAS - Veris Group, LLC - 47QTCA24D0076

Supplement No. 03 dated 04/15/2024

Federal Supply Service Authorized Federal Supply Schedule Price List

Prices Shown Herein are Net (discount deducted)

Online access to contract ordering information, terms and conditions, up to date pricing, and the option to create an electronic delivery order are available through GSA Advantage!®, a menu driven database system. The internet address for GSA Advantage!® is: GSAAdvantage.gov.

Multiple Award Schedule

FPDS Code D301 IT and Telecom – Facility Operation and Maintenance FPDS Code D302 IT and Telecom Systems Development FPDS Code D303 IT and Telecom – Data Entry FPDS Code D305 IT and Telecom – Teleprocessing, Timeshare and Cloud Computing FPDS Code D306 IT and Telecom – Systems Analysis FPDS Code D307 IT and Telcom – IT Strategy and Architecture FPDS Code D308 Programming FPDS Code D310 IT and Telecom Cyber Security and Data Backup FPDS Code D311 IT and Telecom Data Conversion FPDS Code D312 IT and Telecom Optical Scanning FPDS Code D313 IT and Telecom Computer Aided Design/Computer Aided Manufacturing FPDS Code D316 IT and Telecom Telecommunications Network Management FPDS Code D317 IT and Telecom Web-based subscription FPDS Code D319 IT and Telcom Annual Software Maintenance Service Plans FPDS Code D320 IT and Telecom Annual Hardware Maintenance Service Plans FPDS Code D322 IT and Telecom – Internet FPDS Code D324 IT and Telecom – Business Continuity FPDS Code D399 IT and Telecom Other Information Technology Svcs, Not Elsewhere Classified

Note 1: All non-professional labor categories must be incidental to and used solely to support hardware, software and/or professional services, and cannot be purchased separately.

Note 2: Offerors and Agencies are advised that the Multiple Award Schedule is not to be used as a means to procure services that properly fall under the Brooks Act. These services include, but are not limited to, architectural, engineering, mapping, cartographic production, remote sensing, geographic information systems, and related services. FAR 36.6 distinguishes between mapping services of an A/E nature and mapping services that are not connected nor incidental to the traditionally accepted A/E Services.

Note 3: This solicitation is not intended to solicit for the reselling of IT Professional Services, except for the provision of implementation, maintenance, integration, or training services in direct support of a product. Under such circumstances the services must be performance by the publisher or manufacturer or one of their authorized agents.

For more information on ordering from Federal Supply Schedules go to the GSA Schedules page at GSA.gov.

Schedule No.: 47QTCA24D0076 Contract Period: 03/28/2024 – 03/27/2029

Veris Group, LLC dba Coalfire Federal PO BOX 220985 Chantilly, VA 20153

703-935-5749 www.coalfirefederal.com

Large Business http://www.coalfirefederal.com/

Schedule No. 47QTCA24D0076 Supplement No. 02 dated 04/09/2024 2

INFORMATION FOR ORDERING ACTIVITIES (ALL SINS)

CUSTOMER INFORMATION

MAXIMUM ORDER

MINIMUM ORDER

GEOGRAPHIC COVERAGE

POINT(S) OF PRODUCTION

DISCOUNTS FROM LIST PRICE(S)

QUANTITY DISCOUNTS

PROMPT PAYMENT TERMS

FOREIGN ITEMS

DELIVERY

F.O.B POINT(S)

ORDERING INFORMATION

PAYMENT ADDRESS(ES)

WARRANTY PROVISION

EXPORT PACKING CHARGES

RENTAL, MAINTENANCE, AND REPAIR

INSTALLATION

REPAIR PARTS

SERVICE AND DISTRIBUTION POINTS

PARTICIPATING DEALERS

PREVENTIVE MAINTENANCE

SPECIAL ATTRIBUTES

UNIQUE ENTITY IDENTIFIER (UEI) NUMBER

SYSTEM FOR AWARD MANAGEMENT (SAM)

SECTION 2.0 TERMS AND CONDITIONS (ALL SINS)

PERFORMANCE INCENTIVES

ORDER

PERFORMANCE OF SERVICES

STOP-WORK ORDER (FAR 52.242-15)(AUG 1989)

RESPONSIBILITIES OF THE CONTRACTOR

RESPONSIBILITIES OF THE ORDERING ACTIVITY

ORGANIZATIONAL CONFLICT OF INTEREST

INVOICES

PAYMENTS

ADVANCE PAYMENTS

INSPECTION OF SERVICES

INDEPENDENT CONTRACTOR

RESUMES

Supplement No. 02 dated 04/09/2024 3

APPROVAL OF SUBCONTRACTS

INCIDENTAL SUPPORT COSTS

LIABILITY FOR INJURY OR DAMAGE

FEDERAL IT / TELECOMMUNICATION STANDARDS REQUIREMENTS

FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATIONS

FEDERAL TELECOMMUNICATIONS STANDARDS (FED-STDS)

CONTRACTOR TASKS / SPECIAL REQUIREMENTS (C-FSS-370)

CONTRACT ADMINISTRATION FOR ORDERING ACTIVITIES

PURCHASE OF OPEN MARKET ITEMS

OVERSEAS ACTIVITIES

BLANKET PURCHASE AGREEMENTS (BPA)

CONTRACTOR TEAM ARRANGEMENTS

PRIME CONTRACTOR ORDERING FROM FEDERAL SUPPLY SCHEDULES

INSURANCE-WORK ON GOVERNMENT INSTALLATION

SOFTWARE INTEROPERABILITY

SECTION 3.0 TERMS AND CONDITIONS (SIN 54151S)

SCOPE

DESCRIPTION OF IT SERVICES AND PRICING

SIN 54151S COMMERCIAL LABOR CATEGORY DESCRIPTIONS

SIN 54151S LABOR CATEGORY QUALIFICATION EQUIVALENCIES

SECTION 4.0 TERMS AND CONDITIONS (SIN 54151HACS)

SCOPE

DESCRIPTION OF HACS SERVICES AND PRICING

SIN 54151HACS LABOR CATEGORY DESCRIPTIONS

SIN 54151HACS LABOR CATEGORY QUALIFICATION EQUIVALENCIES

SECTION 5.0 SMALL BUSINESS PARTICIPATION PROCUREMENT PROGRAMS

PREAMBLE

COMMITMENT

SECTION 6.0 BLANKET PURCHASE AGREEMENT

SECTION 7.0 ORDER-LEVEL MATERIALS

Supplement No. 02 dated 04/09/2024 4

INFORMATION FOR ORDERING ACTIVITIES (ALL SINS)

CUSTOMER INFORMATION

1.a. Table of Awarded Special Item Number(s)

SIN Descriptions Prices 54151S Information Technology (IT) Professional Services See Section 3.16 54151HACS Highly Adaptive Cybersecurity Services (HACS) See Section 4.12 70-500 Order-Level Materials (OLMS) Priced at the Order Level

1.b. Lowest Price Model Number and Unit Price

Not Applicable

1.c. Commercial Job Titles and Descriptions

SIN 54151S: Information Technology (IT) Professional Services, see Section 3.16 SIN 54151HACS: Highly Adaptive Cybersecurity Services (HACS), see Section 4.12

MAXIMUM ORDER

The Maximum Order value is $500,000. All Dollar Amounts are Exclusive of any Discount for Prompt Payment

MINIMUM ORDER

The minimum dollar value of orders to be issued is $1,000.00

GEOGRAPHIC COVERAGE

Domestic delivery is delivery within the 48 contiguous states, Alaska, Hawaii, Puerto Rico, Washington, DC, and U.S. Territories.

Offerors are requested to check one of the following boxes:

[ ] The Geographic Scope of Contract will be domestic and overseas delivery.

[ ] The Geographic Scope of Contract will be overseas delivery only.

[X] The Geographic Scope of Contract will be domestic delivery only.

POINT(S) OF PRODUCTION

Not Applicable

DISCOUNTS FROM LIST PRICE(S)

SIN 54151S: See Section 3.2 SIN 54151HACS: See Section 4.2 SIN 70-500: To be determined by individual order

QUANTITY DISCOUNTS

None

PROMPT PAYMENT TERMS

Prompt Payment: 0.5% - 10 days from receipt of invoice or date of acceptance, whichever is later.

Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions.

FOREIGN ITEMS

All items are U.S. made end products, designated country end products, Caribbean Basin country end products, Canadian end products, or Mexican end products as defined in the Trade Agreements Act of 1979, as amended.

Supplement No. 02 dated 04/09/2024 5

DELIVERY

10.a. Time of Delivery SPECIAL ITEM NUMBER DELIVERY TIME (Days ARO) 54151S As per client request 54151HACS As per client request 70-500 To be determined by individual order

10.b. Expedited Delivery Items available for expedited delivery are noted in this price list when applicable.

10.c. Overnight and 2-day Delivery As per client request.

10.d. Urgent Requirements When the Federal Supply Schedule contract delivery period does not meet the bona fide urgent delivery requirements of an ordering activity, ordering activities are encouraged, if time permits, to contact the Contractor for the purpose of obtaining accelerated delivery. The Contractor shall reply to the inquiry within 3 workdays after receipt. (Telephonic replies shall be confirmed by the Contractor in writing.) If the Contractor offers an accelerated delivery time acceptable to the ordering activity, any order(s) placed pursuant to the agreed upon accelerated delivery time frame shall be delivered within this shorter delivery time and in accordance with all other terms and conditions of the contract.

F.O.B POINT(S)

Destination

ORDERING INFORMATION

12.a. Ordering Address(es) Corporate Headquarters Veris Group, LLC dba Coalfire Federal

PO BOX 220985

Chantilly, VA 20153 Tel: 703-935-5749| Fax: 703-880-7590 www.coalfirefederal.com

The following telephone number(s) can be used by ordering activities to obtain technical and/or ordering assistance:

Name Title Telephone No.

William Malone Executive Vice President 571-392-5071 Lisa Kennedy Director Federal Contracts 703-935-5749

12.b. Ordering Procedures Ordering activities shall use the ordering procedures of Federal Acquisition Regulation (FAR) 8.405 when placing an order or establishing a Blanket Purchase Agreement (BPA) for supplies or services. These procedures apply to all schedules.

• FAR 8.405-1 Ordering procedures for supplies, and services not requiring a statement of work.

• FAR 8.405-2 Ordering procedures for services requiring a statement of work.

Supplement No. 02 dated 04/09/2024 6

PAYMENT ADDRESS(ES)

Veris Group, LLC dba Coalfire Federal

PO BOX 737709

Dallas, TX 75373-7709 Tel: 571-384-2328 | Fax: 703-880-7590 www.coalfirefederal.com

WARRANTY PROVISION

14.a. For the purpose of this contract, commitments, warranties and representations include, in addition to those agreed to for the entire schedule contract:

• Time of delivery/installation quotations for individual orders;

• Technical representations and/or warranties of products concerning performance, total system performance and/or configuration, physical, design and/or functional characteristics and capabilities of a product/equipment/ service/software package submitted in response to requirements which result in orders under this schedule contract.

• Any representations and/or warranties concerning the products made in any literature, description, drawings and/or specifications furnished by the Contractor.

14.b. The above is not intended to encompass items not currently covered by the GSA Schedule contract.

EXPORT PACKING CHARGES

Not Applicable

RENTAL, MAINTENANCE, AND REPAIR

Not Applicable

INSTALLATION

The Davis-Bacon Act (40 U.S.C. 276a-276a-7) provides that contracts in excess of $2,000 to which the United States or the District of Columbia is a party for construction, alteration, or repair (including painting and decorating) of public buildings or public works with the United States, shall contain a clause that no laborer or mechanic employed directly upon the site of the work shall receive less than the prevailing wage rates as determined by the Secretary of Labor. The requirements of the Davis-Bacon Act do not apply if the construction work is incidental to the furnishing of supplies, equipment, or services. For example, the requirements do not apply to simple installation or alteration of a public building or public work that is incidental to furnishing supplies or equipment under a supply contract. However, if the construction, alteration or repair is segregable and exceeds $2,000, then the requirements of the Davis- Bacon Act applies.

The ordering activity issuing the task order against this contract will be responsible for proper administration and enforcement of the Federal labor standards covered by the Davis-Bacon Act.

The proper Davis-Bacon wage determination will be issued by the ordering activity at the time a request for quotations is made for applicable construction classified installation, deinstallation, and reinstallation services under SIN 33411.

REPAIR PARTS

18.a. Repair Part: Not Applicable 18.b. Terms and Conditions applicable to other services: Not Applicable

SERVICE AND DISTRIBUTION POINTS

Not Applicable

PARTICIPATING DEALERS

Supplement No. 02 dated 04/09/2024 7

PREVENTIVE MAINTENANCE

SPECIAL ATTRIBUTES

22.a. Environmental attributes (e.g., recycled content, energy efficiency, and/or reduced pollutants) are not applicable.

22.b. Section 508 compliance: If applicable, Section 508 compliance information on the supplies and services in this contract are available in Electronic and Information Technology (EIT) at the following:

www.coalfirefederal.com. The EIT standard can be found at: www.Section508.gov/.

UNIQUE ENTITY IDENTIFIER (UEI) NUMBER

Unique Entity Identifier (UEI) number: P2BGLMB7JN52

SYSTEM FOR AWARD MANAGEMENT (SAM)

Coalfire Federal has registered in the System for Award Management Database.

Type of Contractor – Large Business Woman-Owned Small Business – No Contractor's Taxpayer Identification Number (TIN): 20-2300601 Veteran Owned Small Business (VOSB): No CAGE Code: 36BY6 http://www.coalfirefederal.com./ http://www.section508.gov/

Supplement No. 02 dated 04/09/2024 8

SECTION 2.0 TERMS AND CONDITIONS (ALL SINS)

PERFORMANCE INCENTIVES

2.1.a. Performance incentives may be agreed upon between the Contractor and the ordering activity on individual fixed price orders or Blanket Purchase Agreements under this contract in accordance with this contract.

2.1.b. The ordering activity must establish a maximum performance incentive price for these services and/or total solutions on individual orders or Blanket Purchase Agreements.

2.1.c. Incentives should be designed to relate results achieved by the contractor to specified targets. To the maximum extent practicable, ordering activities shall consider establishing incentives where performance is critical to the ordering activity’s mission and incentives are likely to motivate the contractor. Incentives shall be based on objectively measurable tasks.

ORDER

2.2.a. Agencies may use written orders, EDI orders, blanket purchase agreements, individual purchase orders, or task orders for ordering services under this contract. Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made, and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

2.2.b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

PERFORMANCE OF SERVICES

2.3.a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity.

2.3.b. The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

2.3.c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

2.3.d. Any Contractor travel required in the performance services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed.

Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts.

STOP-WORK ORDER (FAR 52.242-15)(AUG 1989)

2.4.a. The Contracting Officer may, at any time, by written order to the Contractor, require the Contractor to stop all, or any part, of the work called for by this contract for a period of 90 days after the order is delivered to the Contractor, and for any further period to which the parties may agree. The order shall be specifically identified as a stop-work order issued under this clause. Upon receipt of the order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the order during the period of work stoppage. Within a period of 90 days after a stop-work is delivered to the Contractor, or within any extension of that period to which the parties shall have agreed, the Contracting Officer shall either- Cancel the stop-work order; or Terminate the work covered by the order as provided in the Default, or the Termination for Convenience of the Government, clause of this contract.

2.4.b. If a stop-work order issued under this clause is canceled or the period of the order or any extension thereof expires, the Contractor shall resume work. The Contracting Officer shall make an equitable

Supplement No. 02 dated 04/09/2024 9 adjustment in the delivery schedule or contract price, or both, and the contract shall be modified, in writing, accordingly, if-

• The stop-work order results in an increase in the time required for, or in the Contractor's cost properly allocable to, the performance of any part of this contract; and

• The Contractor asserts its right to the adjustment within 30 days after the end of the period of work stoppage; provided, that, if the Contracting Officer decides the facts justify the action, the Contracting Officer may receive and act upon the claim submitted at any time before final payment under this contract.

2.4.c. If a stop-work order is not canceled and the work covered by the order is terminated for the convenience of the Government, the Contracting Officer shall allow reasonable costs resulting from the stop-work order in arriving at the termination settlement.

2.4.d. If a stop-work order is not canceled and the work covered by the order is terminated for default, the Contracting Officer shall allow, by equitable adjustment or otherwise, reasonable costs resulting from the stop-work order.

RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering services provided. If the end product of a task order is software, then FAR 52.227-14 Rights in Data-General may apply.

RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite services.

ORGANIZATIONAL CONFLICT OF INTEREST

2.7.a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or (ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

2.7.b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices services rendered. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

Supplement No. 02 dated 04/09/2024 10

PAYMENTS

For firm-fixed price orders the ordering activity shall pay the Contractor, upon submission of proper invoices or vouchers, the prices stipulated in this contract for service rendered and accepted. Progress payments shall be made only when authorized by the order. FAR 52.232-7 Payments under Time and Materials and Labor Hour Contracts applies to time and materials orders placed under this contract.

ADVANCE PAYMENTS

A payment under this contract to provide a service or deliver an article for the United States Government may not be more than the value of the service already provided or the article already delivered. Advance or pre-payment is not authorized or allowed under this contract. (31 U.S.C. 3324).

INSPECTION OF SERVICES

GSAR 552.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services (FAR DEVIATION 52.212-4) applies.

INDEPENDENT CONTRACTOR

All services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity's Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

INCIDENTAL SUPPORT COSTS

Incidental support costs are available outside the scope of this contract. The costs will be negotiated separately with the ordering activity in accordance with the guidelines set forth in the FAR.

LIABILITY FOR INJURY OR DAMAGE

The Contractor shall not be liable for any injury to ordering activity personnel or damage to ordering activity property arising from the use of equipment maintained by the Contractor, unless such injury or damage is due to the fault or negligence of the Contractor.

FEDERAL IT / TELECOMMUNICATION STANDARDS REQUIREMENTS

Ordering activities acquiring products from this Schedule must comply with the provisions of the Federal Standards Program, as appropriate (reference: NIST Federal Standards Index). Inquiries to determine whether or not specific products listed herein comply with Federal Information Processing Standards (FIPS) or Federal Telecommunication Standards (FED-STDS), which are cited by ordering activities, shall be responded to promptly by the Contractor.

FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATIONS

Information Technology products under this Schedule that do not conform to Federal Information Processing Standards (FIPS) should not be acquired unless a waiver has been granted in accordance with the applicable "FIPS Publication." Federal Information Processing Standards Publications (FIPS PUBS) are issued by the U.S. Department of Commerce, National Institute of Standards and Technology (NIST), pursuant to National Security Act. Information concerning their availability and applicability should be obtained from the National Technical Information Service (NTIS), 5285 Port Royal Road, Springfield, Virginia 22161. FIPS PUBS include voluntary standards when these are adopted for Federal use.

Individual orders for FIPS PUBS should be referred to the NTIS Sales Office, and orders for subscription service should be referred to the NTIS Subscription Officer, both at the above address, or telephone number (703) 487-4650.

Supplement No. 02 dated 04/09/2024 11

FEDERAL TELECOMMUNICATIONS STANDARDS (FED-STDS)

Telecommunication products under this Schedule that do not conform to Federal Telecommunication Standards (FED-STDS) should not be acquired unless a waiver has been granted in accordance with the applicable "FED-STD." Federal Telecommunication Standards are issued by the U.S. Department of Commerce, National Institute of Standards and Technology (NIST), pursuant to National Security Act.

Ordering information and information concerning the availability of FED-STDS should be obtained from the GSA, Federal Supply Service, Specification Section, 470 East L’Enfant Plaza, Suite 8100, SW, Washington, DC 20407, telephone number (202)619-8925. Please include a self-addressed mailing label when requesting information by mail. Information concerning their applicability can be obtained by writing or calling the U.S. Department of Commerce, National Institute of Standards and Technology, Gaithersburg, MD 20899, telephone number (301) 975-2833.

CONTRACTOR TASKS / SPECIAL REQUIREMENTS (C-FSS-370)

2.20.a. Security Clearances: The Contractor may be required to obtain/possess varying levels of security clearances in the performance of orders issued under this contract. All costs associated with obtaining/possessing such security clearances should be factored into the price offered under the Multiple Award Schedule.

2.20.b. Travel: The Contractor may be required to travel in performance of orders issued under this contract. Allowable travel and per diem charges are governed by Pub.L. 99-234 and FAR Part 31 and are reimbursable by the ordering agency or can be priced as a fixed price item on orders placed under the Multiple Award Schedule. The Industrial Funding Fee does NOT apply to travel and per diem charges.

NOTE: Refer to FAR Part 31.205-46 Travel Costs, for allowable costs that pertain to official company business travel in regard to this contract.

2.20.c. Certifications, Licenses and Accreditations: As a commercial practice, the Contractor may be required to obtain/possess any variety of certifications, licenses and accreditations for specific FSC/service code classifications offered. All costs associated with obtaining/ possessing such certifications, licenses and accreditations should be factored into the price offered under the Multiple Award Schedule program.

2.20.d. Insurance: As a commercial practice, the Contractor may be required to obtain/possess insurance coverage for specific FSC/service code classifications offered. All costs associated with obtaining/possessing such insurance should be factored into the price offered under the Multiple Award Schedule program.

2.20.e. Personnel: The Contractor may be required to provide key personnel, resumes or skill category descriptions in the performance of orders issued under this contract. Ordering activities may require agency approval of additions or replacements to key personnel.

2.20.f. Organizational Conflicts of Interest: Where there may be an organizational conflict of interest as determined by the ordering agency, the Contractor’s participation in such order may be restricted in accordance with FAR Part 9.5.

2.20.g. Documentation/Standards: The Contractor may be requested to provide products or services in accordance with rules, regulations, OMB orders, standards and documentation as specified by the agency’s order.

2.20.h. Data/Deliverable Requirements: Any required data/deliverables at the ordering level will be as specified or negotiated in the agency’s order.

2.20.i. Government-Furnished Property: As specified by the agency’s order, the Government may provide property, equipment, materials or resources as necessary.

Supplement No. 02 dated 04/09/2024 12

2.20.j. Availability of Funds: Many Government agencies’ operating funds are appropriated for a specific fiscal year. Funds may not be presently available for any orders placed under the contract or any option year. The Government’s obligation on orders placed under this contract is contingent upon the availability of appropriated funds from which payment for ordering purposes can be made. No legal liability on the part of the Government for any payment may arise until funds are available to the ordering Contracting Officer.

2.20.k. Overtime: For professional services, the labor rates in the Schedule should not vary by virtue of the Contractor having worked overtime. For services applicable to the Service Contract Act (as identified in the Schedule), the labor rates in the Schedule will vary as governed by labor laws (usually assessed a time and a half of the labor rate).

CONTRACT ADMINISTRATION FOR ORDERING ACTIVITIES

Any ordering activity, with respect to any one or more delivery orders placed by it under this contract, may exercise the same rights of termination as might the GSA Contracting Officer under provisions of FAR 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services, paragraphs

(l) Termination for the Government’s convenience, and (m) Termination for Cause.

PURCHASE OF OPEN MARKET ITEMS

NOTE: Open Market Items are also known as incidental items, noncontract items, non-Schedule items, and items not on a Federal Supply Schedule contract. ODCs (Other Direct Costs) are not part of this contract and should be treated as open market purchases. Ordering Activities procuring open market items must follow FAR 8.402(f).

For administrative convenience, an ordering activity contracting officer may add items not on the Federal Supply Multiple Award Schedule (MAS) -- referred to as open market items -- to a Federal Supply Schedule blanket purchase agreement (BPA) or an individual task or delivery order, only if:

(a) All applicable acquisition regulations pertaining to the purchase of the items not on the Federal Supply Schedule have been followed (e.g., publicizing (Part 5), competition requirements (Part 6), acquisition of commercial items (Part 12), contracting methods (Parts 13, 14, and 15), and small business programs (Part 19));

(b) The ordering activity contracting officer has determined the price for the items not on the Federal Supply Schedule is fair and reasonable;

(c) The items are clearly labeled on the order as items not on the Federal Supply Schedule; and

(d) All clauses applicable to items not on the Federal Supply Schedule are included in the order.

OVERSEAS ACTIVITIES

The terms and conditions of this contract shall apply to all orders for installation, maintenance and repair of equipment in areas listed in the pricelist outside the 48 contiguous states and the District of Columbia, except as indicated below:

Upon request of the Contractor, the ordering activity may provide the Contractor with logistics support, as available, in accordance with all applicable ordering activity regulations. Such ordering activity support will be provided on a reimbursable basis and will only be provided to the Contractor's technical personnel whose services are exclusively required for the fulfillment of the terms and conditions of this contract.

BLANKET PURCHASE AGREEMENTS (BPA)

The use of BPAs under any schedule contract to fill repetitive needs for supplies or services is allowable.

BPAs may be established with one or more schedule contractors. The number of BPAs to be established is within the discretion of the ordering activity establishing the BPA and should be based on a strategy that is expected to maximize the effectiveness of the BPA(s). Ordering activities shall follow FAR 8.405- 3 when creating and implementing BPA(s).

CONTRACTOR TEAM ARRANGEMENTS

Contractors participating in contractor team arrangements must abide by all terms and conditions of their respective contracts. This includes compliance with GSAR Clauses 552.238-80, Industrial Funding Fee

Supplement No. 02 dated 04/09/2024 13 and Sales Reporting (JUL 2020), i.e., each contractor (team member) must report sales and remit the IFF for all products and services provided under its individual contract.

PRIME CONTRACTOR ORDERING FROM FEDERAL SUPPLY SCHEDULES

Prime Contractors (on cost reimbursement contracts) placing orders under Federal Supply Schedules, on behalf of an ordering activity, shall follow the terms of the applicable schedule and authorization and include with each order –

2.26.a. A copy of the authorization from the ordering activity with whom the contractor has the prime contract (unless a copy was previously furnished to the Federal Supply Schedule contractor); and

2.26.b. The following statement:

This order is placed under written authorization from dated . In the event of any inconsistency between the terms and conditions of this order and those of your Federal Supply Schedule contract, the latter will govern.

INSURANCE-WORK ON GOVERNMENT INSTALLATION

2.27.a. In accordance with FAR 52.228-5 Insurance-Work on a Government Installation, the Contractor shall, at its own expense, provide and maintain during the entire performance of this contract, at least the kinds and minimum amounts of insurance required in the Schedule or elsewhere in the contract.

2.27.b. Before commencing work under this contract, the Contractor shall notify the Contracting Officer in writing that the required insurance has been obtained. The policies evidencing required insurance shall contain an endorsement to the effect that any cancellation or any material change adversely affecting the Government's interest shall not be effective —

For such period as the laws of the State in which this contract is to be performed prescribe; or Until 30 days after the insurer or the Contractor gives written notice to the Contracting Officer, whichever period is longer.

2.27.c. The Contractor shall insert the substance of this clause, including this paragraph (c), in subcontracts under this contract that require work on a Government installation and shall require subcontractors to provide and maintain the insurance required in the Schedule or elsewhere in the contract. The Contractor shall maintain a copy of all subcontractors' proofs of required insurance and shall make copies available to the Contracting Officer upon request.

SOFTWARE INTEROPERABILITY

Offerors are encouraged to identify within their software items any component interfaces that support open standard interoperability. An item’s interface may be identified as interoperable on the basis of participation in a Government agency-sponsored program or in an independent organization program.

Interfaces may be identified by reference to an interface registered in the component registry located at http://www.core.gov.

http://www.core.gov/

Supplement No. 02 dated 04/09/2024 14

SECTION 3.0 TERMS AND CONDITIONS (SIN 54151S)

SCOPE

3.1a. The prices, terms and conditions stated under Special Item Number 54151S Information Technology Professional Services apply exclusively to Information Technology Professional Services.

3.1b. Services will be provided at Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

DESCRIPTION OF IT SERVICES AND PRICING

The following pages contain the description of categories of Information Technology Professional Services offered along with the corresponding prices.

Table 1: 3.17 SIN 54151S IT Services Government Site Hourly Rates1

03/28/24 03/27/25

03/28/25 03/27/26

03/28/26 03/27/27

03/28/27 03/27/28

03/28/28 03/27/29

SIN. No. Labor Category Year 1 Year 2 Year 3 Year 4 Year 5 54151S-1 Project Manager I $122.80 $127.34 $132.05 $136.94 $142.01 54151S-2 Project Manager II $153.63 $159.31 $165.21 $171.32 $177.66 54151S-3 Project Manager III $171.91 $178.28 $184.88 $191.72 $198.81 54151S-4 Project Manager IV $196.47 $203.75 $211.28 $219.10 $227.21 54151S-5 Security Engineer I $117.37 $121.71 $126.22 $130.88 $135.73 54151S-6 Security Engineer II $135.24 $140.24 $145.43 $150.81 $156.39 54151S-7 Security Engineer III $140.76 $145.97 $151.38 $156.98 $162.78 54151S-8 Security Engineer IV $176.83 $183.37 $190.15 $197.18 $204.47 54151S-9 Consultant I $96.43 $100.00 $103.70 $107.54 $111.52 54151S-10 Consultant II $122.80 $127.34 $132.05 $136.94 $142.01 54151S-11 Consultant III $157.18 $162.99 $169.03 $175.28 $181.77 54151S-12 Consultant IV $176.83 $183.37 $190.15 $197.18 $204.47 54151S-13 Penetration Tester I $121.81 $126.32 $130.99 $135.84 $140.87 54151S-14 Penetration Tester II $135.18 $140.18 $145.37 $150.75 $156.33 54151S-15 Penetration Tester III $176.83 $183.37 $190.15 $197.18 $204.47 54151S-16 Penetration Tester IV $221.03 $229.21 $237.69 $246.49 $255.61 54151S-17 Subject Matter Expert I $213.78 $221.69 $229.89 $238.40 $247.21 54151S-18 Subject Matter Expert II $234.26 $242.92 $251.91 $261.23 $270.89 54151S-19 Subject Matter Expert III $240.77 $249.68 $258.92 $268.50 $278.44 54151S-20 Subject Matter Expert IV $249.68 $258.91 $268.49 $278.43 $288.73 *Coalfire Federal applies a fixed escalation rate of 3.7% based on the Bureau of Labor Statistics Employment Cost Index (ECI), Table 5: Compensation – Not Seasonally Adjusted – Employment Cost Index for Total Compensation, for Private Industry Workers, by Occupational Group and Industry.

Note: The rates listed above include the Industrial Funding Fee (IFF).

Supplement No. 02 dated 04/09/2024 15

SIN 54151S COMMERCIAL LABOR CATEGORY DESCRIPTIONS

Labor Category

Labor Category/Service Description Minimum Education

Certifications or Licenses

Min. Years Experience

Project Manager I

The Project Manager may perform any or all of the following: Provides the interface and communication to the customer and other project leaders. Identifies, acquires, and utilizes company resources to achieve project technical objectives. Performs staff assignments to meet all project priorities and deadlines. Ensures quality and productivity standards are maintained while meeting project/client deadlines.

Associates At least one of the following certifications:

CAPM, PMP, or two

(2) or more years in a commensurate role

Project Manager II

The Project Manager may perform any or all of the following: Leads the project or multiple tasks and retains overall responsibility for performance including cost, schedule, deliverables and overall contractual compliance.

Provides the interface to the customer and other project leaders. Identifies, acquires, and utilizes company resources to achieve project technical objectives. Performs staff assignments to meet all project priorities and deadlines. Ensures quality and productivity standards are maintained while meeting project/client deadlines and budget constraints. Supervises the training of new personnel under the project to assure compliance with regulations, standards, policies, and procedures.

Bachelors At least one of the following certifications:

CAPM, PMP, or two

(2) or more years in a commensurate role

Project Manager III

The Project Manager may perform any or all of the following: Central point of contact with the Contracting Officer, Contracting Officer’s Representative and Task Managers.

Responsible for coordinating the management of all work performed on contract, including subcontractors, team members, and vendors.

Keeps in constant touch with the project managers regarding the status of various task order projects, the issues facing the project teams and effectively and regularly updates the client representatives. Also facilitates the information, which the team requires from the client to effectively implement various Task Order Projects and if necessary, escalates the issues to the client representatives and contract officer. Supervises the training of new personnel under the project to assure compliance with regulations, standards, policies, and procedures.

Bachelors At least one of the following certifications:

PMP, CISSP, CISM or five (5) or more years in a commensurate role

Project Manager IV

The Project Manager may perform any or all of the following: Central point of contact with the Contracting Officer, Contracting Officer’s Representative and Task Managers for multi-year blanket purchase agreement (BPA) and indefinite delivery indefinite quantity (IDIQ)

Bachelors At least one of the following certifications:

PMP, CISSP or seven

(7) or more years in a commensurate role

Supplement No. 02 dated 04/09/2024 16

Labor Category/Service Description Minimum Education

Certifications or Licenses

Min. Years Experience contracts and subordinate task orders.

Responsible for coordinating the management of all work performed on contract, including subcontractors, team members, and vendors.

Keeps in constant touch with the project managers regarding the status of various task order projects, the issues facing the project teams and effectively and regularly updates the client representatives. Also facilitates the information, which the team requires from the client to effectively implement various Task Order Projects and if necessary, escalates the issues to the client representatives and contract officer. Supervises the training of new personnel under the project to assure compliance with regulations, standards, policies, and procedures.

Security Engineer I

The Security Engineer may perform any or all of the following: Designs, develops, engineers, and implements solutions that meet security requirements. Gathers and organizes technical information about an organization's mission goals and needs, existing security products, and ongoing programs in computer security.

Performs evaluation and risk analysis of computer systems and applications during all phases of the system development lifecycle.

Associates At least one of the following certifications:

A+ CE, CCNA-

Security, CND, Network+ CE, CAP, Cloud+, GSLC, Security+ CE, HCISSP or 2 or more years in a commensurate role

Security Engineer II

The Security Engineer may perform any or all of the following: Designs, configures, reviews, or defines security requirements for complex networks, enterprise architecture, computer systems and environments, which may include security applications, mainframes, networks, servers, workstations, and personal computers.

Designs, develops, engineers, and implements solutions that meet security requirements.

Responsible for integration and implementation of the computer system security solution.

Performs evaluation and risk analysis of computer systems and applications during all phases of the system development lifecycle.

Supports the training of new security engineers and team members to assure compliance with regulations, standards, policies, and procedures.

Bachelors At least one of the following certifications:

A+ CE, CCNA-

Security, CND, Network+ CE, CAP, Cloud+, GSLC, Security+ CE, HCISSP or 2 or more years in a

Supplement No. 02 dated 04/09/2024 17

Labor Category/Service Description Minimum Education

Certifications or Licenses

Min. Years Experience

Security Engineer III

The Security Engineer may perform any or all of the following: Designs, configures, reviews, or defines security requirements for complex networks, enterprise architecture, computer systems and environments, which may include security applications, mainframes, networks, servers, workstations, and personal computers.

Designs, develops, engineers, and implements solutions that meet security requirements.

Responsible for integration and implementation of the computer system security solution.

Gathers and organizes technical information about an organization's mission goals and needs, existing security products, and ongoing programs in computer security. Performs evaluation and risk analysis of computer systems and applications during all phases of the system development lifecycle. Manages other security engineers and supports the training of new security engineers and team members to assure compliance with regulations, standards, policies, and procedures.

Bachelors At least one of the following certifications:

CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, SSCP, CISA, CASP+

CE, GSLC, CCISO,

HCISPP, CIPP, or five

(5) or more years in a commensurate role.

Security Engineer

IV

The Security Engineer may perform any or all of the following: Security engineering team lead who facilitates decision making of security engineer related tasks with organizational leaders and helps delegate work assignments to the engineering team. Recognized as a subject matter expert in one or more security engineering domains or specific products.

Designs, configures, reviews, or defines security requirements for complex networks, enterprise architecture, computer systems and environments, which may include security applications, mainframes, networks, servers, workstations, and personal computers. Designs, develops, engineers, and implements solutions that meet security requirements. Responsible for integration and implementation of the computer system security solution. Gathers and organizes technical information about an organization's mission goals and needs, existing security products, and ongoing programs in computer security. Performs evaluation and risk analysis of computer systems and applications during all phases of the system development lifecycle. Manages other security engineers and supports the training of new security engineers and team members to assure compliance with regulations, standards, policies, and procedures.

Bachelors At least one of the following certifications:

CASP+ CE, CCNP

Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP, CISM, GSLC, CCISO, or seven (7) or more years in a

Supplement No. 02 dated 04/09/2024 18

Labor Category/Service Description Minimum Education

Certifications or Licenses

Min. Years Experience

Consultant I

The Consultant may perform any or all of the following: Serves as a consulting team member with an information technology background.

Collects data in accordance with plans developed by others. Verifies and analyzes data to identify trends and relationships as well as current and potential technical and management problems. Drafts reports of findings along with related documentation.

Associates At least one of the following certifications:

A+ CE, CCNA-

Security, CND, Network+ CE, CAP, Cloud+, GSLC, Security+ CE, HCISSP or 2 or more years in a commensurate role

Consultant

II

The Consultant may perform any or all of the following: Serves as a consulting team member with an information technology background.

Collects data in accordance with plans developed by others. Verifies and analyzes data to identify trends and relationships as well as current and potential technical and management problems. Drafts reports of findings along with related documentation. Serves as a small team lead or individual contributor.

Bachelors At least one of the following certifications:

A+ CE, CCNA-

Security, CND, Network+ CE, CAP, Cloud+, GSLC, Security+ CE, HCISSP or 2 or more years in a commensurate role

Consultant

III

The Consultant may perform any or all of the following: Serves as a senior member of consulting teams as a task manager or as a project leader on projects of limited scope and complexity. As a consulting team member, collects, analyzes, and interprets data in one or more information technology specialties.

Develops, or participates in the development of assignment methodology.

Bachelors At least one of the following certifications:

CCNA-Security, CySA+, GICSP, GSEC, Security+ CE, SSCP, CISA, CASP+

CE, GSLC, CCISO,

HCISPP, CIPP, or five

(5) or more years in a commensurate role.

Consultant

IV

The Consultant may perform any or all of the following: Serves as independent expert or senior member of consulting teams or acts as a task manager or as a project leader on projects of substantial scope and complexity. As a consulting team member or independent expert, collects, analyzes, and interprets data in one or more information technology or management specialties. Develops or participates in the development of assignment methodology.

Bachelors At least one of the following certifications:

CASP+ CE, CCNP

Security, CISA, CISSP (or Associate), GCED, GCIH, CCSP, CISM, GSLC, CCISO, or seven (7) or more years in a commensurate role

Penetration Tester I

The Penetration Tester may perform any or all of the following: Function as an entry-level individual contributor that emulates real-world attacks against facilities and information systems (e.g., hardware, software, data, procedures, and people) with prior authorization. Testers identify vulnerabilities that could or may be exploited to impact the operations of a target organization or information system resulting in the loss of confidentiality, integrity, availability of the facilities, information systems, and the data they store, process, and transmit. The Penetration

Associates At least one of the following certifications:

CEH, CFP, CCNA

Cyber Ops, CCNA- Security, CySA+**, GCIA, GCIH, GISCP, Cloud+, SCYBER, PenTest+, or four (4) or more years in a

Supplement No. 02 dated 04/09/2024 19

Labor Category/Service Description Minimum Education

Certifications or Licenses

Min. Years Experience

Tester I is familiar with concepts such as intelligence gathering; network, web and vulnerability scanning; enumeration; exploitation and post-exploitation techniques; and report writing.

Penetration Tester II

The Penetration Tester may perform any or all of the following: Function as a mid-level individual contributor that emulates real-world attacks against facilities and information systems (e.g., hardware, software, data, procedures, and people) with prior authorization. Testers identify vulnerabilities that could or may be exploited to impact the operations of a target organization or information system resulting in the loss of confidentiality, integrity, availability of the facilities, information systems, and the data they store, process, and transmit. The Penetration Tester II is familiar with concepts such as intelligence gathering; network, web and vulnerability scanning; enumeration; exploitation and post-exploitation techniques; and report writing.

Associates At least one of the following certifications:

CEH, CFP, CCNA

Cyber Ops, CCNA- Security, CySA+**, GCIA, GCIH, GISCP, Cloud+, SCYBER, PenTest+, or four (4) or more years in a commensurate role

Penetration Tester III

The Penetration Tester may perform any or all of the following: Function as a senior-level individual contributor or subject matter expert without direct supervisory responsibilities that emulates real-world attacks against facilities and information systems (e.g., hardware, software, data, procedures, and people) with prior authorization.