MAS - Unatek Inc. - 47QTCA24D00E3

GENERAL SERVICES ADMINISTRATION

Federal Supply Schedule

Authorized Federal Supply Schedule Price List

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order are available through GSA Advantage!®, a menu-driven database system. The INTERNET address GSA Advantage!® is: GSAAdvantage.gov.

Multiple Award Schedule (MAS)

FSC Group: Information Technology Category

Contract: 47QTCA24D00E3

Contract Period: August 13, 2024, through August 12, 2029

Unatek, Inc.

1401 Mercantile Lane, Suite 200A

Largo, MD 20774 www.unatek.com

Telephone: (301) 741-0664

Fax: (240) 395-2347

Contract Administrator: Theresa Iheagwara tiheagwara@unatek.com

Business Size: Small Business, SBA Certified Small Disadvantaged Business

For more information on ordering from Federal Supply Schedules go to the GSA Schedules page at GSA.gov.

http://www.maximumquestgroup.com/ mailto:tiheagwara@unatek.com

Customer Information

1a. Table of Awarded Special Item Numbers (SIN)

SIN SIN Title

611420 Information Technology Training (PSC Code U012)

54151HACS Highly Adaptive Cybersecurity Services (PSC Code DJ01)

• Cyber Hunt

• High Value Asset Assessments

• Incident Response

• Penetration Testing

• Risk and Vulnerability Assessments

1b Identification of the lowest priced model number and lowest unit price for that model for each special item number awarded in the contract. This price is the Government price based on a unit of one, exclusive of any quantity/dollar volume, prompt payment, or any other concession affecting price. Those contracts that have unit prices based on the geographic location of the customer, should show the range of the lowest price, and cite the areas to which the prices apply. Not Applicable.

1c If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles, experience, functional responsibility and education for those types of employees or subcontractors who will perform services shall be provided. If hourly rates are not applicable, indicate “Not applicable” for this item. Pricelist with hourly rates shown below. See page 27.

2. Minimum Order: The minimum dollar value of orders to be issued is $100.00.

3. Maximum Order: (All dollar amounts are exclusive of any discounts for prompt payment)

A. The Maximum Order value for the following Special Item Numbers (SIN) is $500,000.00:

Special Item Number 54151HACS – Highly Adaptive Cybersecurity Services (HACS)

B. The Maximum Order value for the following Special Item Numbers (SIN) is $500,000.00:

Special Item Number 611420 –Training Courses

4. Geographic Scope of Contract:

The 48 Contiguous states and the District of Columbia and Alaska, Hawaii and Puerto Rico.

5. Point(s) of production (city, county, and State or foreign country): 1401 Mercantile Lane, Suite 200A, Largo, MD 20774

6. Discounts: Prices shown are NET Prices; Basic Discounts have been deducted.

7. Quantity Discounts: Prices shown are NET Prices; Basic Discounts have been deducted.

a. Dollar Volume- 1% for order over $250,000 for SIN 611420 and 1% for order over $20,000 for SIN 54151HACS.

b. Government Educational Institutions- Same as discounts/pricing terms and conditions as all other government.

c. Other- none.

8. Prompt Payment: 0.5% – Net 15 days from receipt of invoice or date of acceptance, whichever is later.

9. FOREIGN ITEMS

The terms and conditions of this contract shall apply to all orders for installation, maintenance and repair of equipment in areas listed in the pricelist outside the 48 contiguous states and the District of Columbia, except as indicated below:

NONE

Upon request of the Contractor, the Government may provide the Contractor with logistics support, as available, in accordance with all applicable Government regulations. Such Government support will be provided on a reimbursable basis and will only be provided to the

Contractor's technical.

10a. TIME OF DELIVERY: The Contractor shall deliver to destination within the number of calendar days after receipt of order

(ARO), as set forth below:

SPECIAL ITEM NUMBER DELIVERY TIME (Days ARO)

611420 As Agreed upon between Unatek, Inc., and the ordering Agency.

54151HACS As Agreed upon between Unatek, Inc., and the ordering Agency.

Unatek shall reply to inquiries within 3 workdays after receipt. (Telephonic replies shall be confirmed by the Unatek in writing.) If the

Unatek offers an accelerated delivery time acceptable to the ordering agency, any order(s) placed pursuant to the agreed upon accelerated delivery time frame shall be delivered within this shorter delivery time and in accordance with all other terms and conditions of the contract.

10b. Expedited Delivery: Items available for expedited delivery are noted in this price list, if applicable, under this heading.

10c. Overnight and 2-day delivery: The Contractor will indicate whether overnight and 2-day delivery are available.

Also, the Contractor will indicate that the schedule customer may contact the Contractor for rates for overnight and 2-day delivery. Not Applicable

10d. Urgent Requirements: When the Federal Supply Schedule contract delivery period does not meet the bona fide urgent delivery requirements of an ordering agency, agencies are encouraged, if time permits, to contact the Contractor for the purpose of obtaining accelerated delivery. The Contractor shall reply to the inquiry. within 3 workdays after receipt. (Telephonic replies shall be confirmed by the

Contractor in writing.) If the Contractor offers an accelerated delivery time acceptable to the ordering agency, any order(s) placed pursuant to the agreed upon accelerated delivery time frame shall be delivered within this shorter delivery time and in accordance with all other terms and conditions of the contract.

11. FOB Destination including Alaska, Hawaii and Puerto Rico.

12a. Ordering Address: Unatek, Inc.

1401 Mercantile Lane, Suite 200A, Largo, MD 20774

Phone: 301- 741-0664

Fax: 240-395-2347

12b. Ordering Procedure:

[NOTE: Special ordering procedures have been established for Special Item Numbers (SINs) 54151HACS Highly Adaptive Cybersecurity

Services (HACS); refer to the terms and conditions for those SINs.]

Ordering activities shall use the ordering procedures of Federal Acquisition Regulation (FAR) 8.405-3 when placing an order or establishing a

BPA for supplies or services. These procedures apply to all schedules.

a. FAR 8.405-1 Ordering procedures for supplies, and services not requiring a statement of work.

b. FAR 8.405-2 Ordering procedures for services requiring a statement of work.

13. Payment Address: Unatek, Inc.

1401 Mercantile Lane, Suite 200A, Largo, MD 20774

Phone: 301- 741-0664

Fax: 240-395-2347

14. WARRANTY PROVISION: Standard Commercial Warranty Terms & Conditions

a. For the purpose of this contract, commitments, warranties and representations include, in addition to those agreed to for the entire schedule contract:

(1) Time of delivery/installation quotations for individual orders;

(2) Technical representations and/or warranties of products concerning performance, total system performance and/or configuration, physical, design and/or functional characteristics and capabilities of a product/equipment/ service/software package submitted in response to requirements which result in orders under this schedule contract.

(3) Any representations and/or warranties concerning the products made in any literature, description, drawings and/or specifications furnished by the Contractor.

b. The above is not intended to encompass items not currently covered by the GSA Schedule contract.

15. Export packing charges: Not Applicable

16. Terms and conditions of Government purchase card acceptance: (any thresholds above the micro- purchase level): Not

Applicable

A payment under this contract to provide a service or deliver an article for the United States Government may not be more than the value of the service already provided or the article already delivered. Advance or pre-payment is not authorized or allowed under this contract. (31 U.S.C. 3324)

17. Terms and conditions of rental, maintenance, and repair (if applicable): Not Applicable

18. Terms and conditions of installation (if applicable): Not Applicable.

19. Terms and conditions of repair parts indicating date of parts price lists and any discounts from list prices (if applicable): Not Applicable.

20. Terms and conditions for any other services (if applicable): Not Applicable.

21. List of service and distribution points (if applicable): Not Applicable.

22. List of participating dealers (if applicable): Not Applicable.

23. Preventive maintenance (if applicable): Not Applicable.

24a Special attributes such as environmental attributes (e.g., recycled content, energy efficiency, and/or reduced pollutants): Not Applicable.

24b. SECTION 508 COMPLIANCE.

If applicable, Section 508 compliance information on the supplies and services in this contract are available in Electronic and Information

Technology (EIT) at the following:

Full details of the EIT standard can be found at: www.Section508.gov/.

25. Unique Entity Identifier (UEI) number: P85ATJEHX6Y3.

26. Notification regarding registration in System for Award Management (SAM) database: SAM is current.

http://www.section508.gov/

Unatek, Inc. GSA Multiple Award Schedule

Authorized FSS Schedule Price List

TERMS AND CONDITIONS APPLICABLE TO PURCHASE OF TRAINING COURSES

(SPECIAL ITEM NUMBER 611420)

1. SCOPE

a. The Contractor shall provide training courses normally available to commercial customers, which will permit Government users to make full, efficient use of general-purpose commercial IT products. Training is restricted to training courses for those products within the scope of this solicitation.

b. The Contractor shall provide training at the Contractor's facility and/or at the Government's location, as agreed to by the Contractor and the Government.

2. ORDER

Written orders, EDI orders (GSA Advantage! and FACNET), credit card orders, and orders placed under blanket purchase agreements (BPAs) shall be the basis for the purchase of training courses in accordance with the terms of this contract. Orders shall include the student's name, course title, course date and time, and contracted dollar amount of the course.

3. TIME OF DELIVERY

The Contractor shall conduct training on the date (time, day, month, and year) agreed to by the Contractor and the

Government.

4. CANCELLATION AND RESCHEDULING

a. The Government will notify the Contractor at least seventy-two (72) hours before the scheduled training date, if a student will be unable to attend. The Contractor will then permit the Government to either cancel the order or reschedule the training at no additional charge. In the event the training class is rescheduled, the Government will modify its original training order to specify the time and date of the rescheduled training class.

b. In the event the Government fails to cancel or reschedule a training course within the time frame specified in paragraph a, above, the Government will be liable for the contracted dollar amount of the training course. The

Contractor agrees to permit the Government to reschedule a student who fails to attend a training class within ninety

(90) days from the original course date, at no additional charge.

c. The Government reserves the right to substitute one student for another up to the first day of class.

d. In the event the Contractor is unable to conduct training on the date agreed to by the Contractor and the

Government, the Contractor must notify the Government at least seventy-two (72) hours before the scheduled training date.

Unatek, Inc. GSA Multiple Award Schedule

5. FOLLOW-UP SUPPORT

The Contractor agrees to provide each student with unlimited telephone support for a period of one (1) year from the completion of the training course. During this period, the student may contact the Contractor's instructors for refresher assistance and answers to related course curriculum questions.

6. PRICE FOR TRAINING

The price that the Government will be charged will be the Government training price in effect at the time of order placement, or the Government price in effect at the time the training course is conducted, whichever is less.

7. INVOICES AND PAYMENT

Invoices for training shall be submitted by the Contractor after Government completion of the training course.

Charges for training must be paid in arrears (31 U.S.C. 3324). PROMPT PAYMENT DISCOUNT, IF

APPLICABLE, SHALL BE SHOWN ON THE INVOICE.

8. FORMAT AND CONTENT OF TRAINING

a. The Contractor shall provide written materials (i.e., manuals, handbooks, texts, etc.) normally provided with course offerings. Such documentation will become the property of the student upon completion of the training class.

b. **If applicable** For hands-on training courses, there must be a one-to-one assignment of IT equipment to students.

c. The Contractor shall provide each student with a Certificate of Training at the completion of each training course.

d. The Contractor shall provide the following information for each training course offered:

(1) The course title and a brief description of the course content, to include the course format (e.g., lecture, discussion, hands-on training);

(2) The length of the course;

(3) Mandatory and desirable prerequisites for student enrollment;

(4) The minimum and maximum number of students per class;

(5) The locations where the course is offered;

(6) Class schedules; and

(7) Price (per student, per class (if applicable)).

e. For those courses conducted at the Government’s location, instructor travel charges (if applicable), including mileage and daily living expenses, must be indicated below. Rates paid as a result of travel must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Contractors cannot use GSA city pair contracts.

Government Per Diem Rate will be applicable.

9. “NO CHARGE” TRAINING

The Contractor shall describe any training provided with equipment and/or software provided under this contract, free of charge, in the space provided below.

NONE.

Unatek, Inc. GSA Multiple Award Schedule

Description of Information Technology Training Courses

Unatek offers online as well as on-site training in our state-of-the-art learning lab. Our instructors have extensive experience as both practitioners and trainers.

Courses

1. QA Security Testing Training

2. Secure Development and Secure Cloud Training

3. Web Application Penetration Testing Training

4. Mobile Application Penetration Testing Training

5. FISMA

6. Certified Ethical Hacker

7. CISSP

8. CCSP

9. Cybersecurity Training

10. Domain Name System Training

11. CompTIA Security+

What's Included?

• Expert Instruction from our instructors with real-world experience.

• Guaranteed good class size, you get an intimate learning setting.

• All meals, snacks and refreshments included for onsite classes.

• Lecture, Lab Exercise and Textbook

• Online access with every tool and custom script used in course where applicable.

Unatek, Inc. GSA Multiple Award Schedule

1. QA Security Testing Training

Length: 3 days course

Course Overview

The popularity of this course is growing exponentially for companies who have their internally developed web applications tested by their QA team.

This is because this course enables the QA team to perform basic security testing to identify “low hanging” vulnerabilities. This course covers the strategies for the successful implementation of reliable and secure software in the organization. This increases the effectiveness of your QA team, increases the security of your web applications, and increases the value of penetration testing since the specialists can then focus on identifying the more advanced attacks. Therefore, this course provides context-based analysis of what is required to sort through the most vexing challenges in enterprise software development and use.

Course Outcome This increases the effectiveness of your QA team, increases the security of your web applications, and increases the value of penetration testing since the specialists can then focus on identifying the more advanced attacks.

Who Should Attend?

• QA Testers

• QA Managers

2. Secure Developer and Secure Coding Training

Length: 3 days course

Web applications are a primary avenue that hackers exploit to break into organization’s applications and internal systems to steal corporate data. It is critical that developers understand how to write code that proactively protects the organization from attacks. This course provides developers with not only a clear understanding of web application attacks and risk mitigation techniques, but also provides them with hands on practical experience in testing their code. This enables them to identify and fix a wide range of vulnerabilities in their code.

Course Outcomes This course provides developers with not only a clear understanding of web application attacks and risk mitigation techniques, but also provides them with hands on practical experience in testing their code. This enables them to identify and fix a wide range of vulnerabilities in their code.

• Web Application Developers

• Development Managers

Unatek, Inc. GSA Multiple Award Schedule

Foundation

3. Web Application Penetration Testing Training

Length: 2 days course

Web applications are a primary avenue that hackers exploit to break into organization’s applications and internal systems to steal corporate data. It is fast becoming a crucial security skill to be able to perform penetration testing of your corporate web applications to identify critical risks to the business.

This course teaches students:

• The concepts for each of the wide range of web application vulnerabilities,

• The impact of successful exploitation of each of these vulnerabilities,

• How to identify and exploit web application vulnerabilities using a series of hands-on web application penetration testing labs, and

• How to fix the vulnerabilities to ensure that mitigation controls are also understood.

This course teaches students:

• The concepts for each of the wide range of web application vulnerabilities,

• The impact of successful exploitation of each of these vulnerabilities,

• How to identify and exploit web application vulnerabilities using a series of hands on web application penetration testing labs, and

• How to fix the vulnerabilities to ensure that mitigation controls are also understood.

• Security Officers

• Penetration Testers

• Web Application Developers

• Security Auditors

• Web Server and Application Server System Administrators

• Managers who want to gain a more in depth understanding of how web applications can be compromised

Unatek, Inc. GSA Multiple Award Schedule

4. Mobile Application Penetration Testing Training

Mobile apps have become a key part of corporate strategies in recent years. This also means that experience in developing secure mobile apps and secure mobile web services is lacking. This leads to critical vulnerabilities being introduced into your organization. This course provides students with not only a clear understanding of mobile app vulnerabilities and mobile web service vulnerabilities, but also provides them with hands on practical experience in exploiting mobile vulnerabilities on iPhone/iPad and Android. This enables them to identify a wide range of vulnerabilities in their code, allowing these vulnerabilities to then be mitigated by the mobile developers.

This course provides students with not only a clear understanding of mobile app vulnerabilities and mobile web service vulnerabilities, but also provides them with hands on practical experience in exploiting mobile vulnerabilities on iPhone/iPad and Android. This enables them to identify a wide range of vulnerabilities in their code, allowing these vulnerabilities to then be mitigated by the mobile developers.

• Penetration Testers

• Mobile App Developers

• Mobile Web Service Developers

• Managers who want to gain a more in depth understanding of how mobile apps can be compromised

Unatek, Inc. GSA Multiple Award Schedule

5. FISMA

The course presents an overview of FISMA compliance requirements and discusses what documentation is needed, and what types of information to include in each document. Students are taught how to develop the different deliverables required for FISMA compliance. Students will learn what is meant by a security control and how security controls are incorporated into a System Security Plan. Similarly, students will also learn what is meant by a security control enhancement and how enhancements are incorporated into a System Security Plan. The instructor will explain to students how to find information for security control descriptions, and what constitutes an acceptable control description. The instructor will review real life control description examples with students. Students should feel free to bring questions related to System Security Plans that they're currently working on.

The learning objectives for this two-day, Executive, Manager and Operations Level course, are broad ranging and include a number of concepts and strategies including understanding the:

• Requirements of the new Presidential, OMB, DHS, and NIST requirements

• Draft updates to include NIST CSF, Risk Management Framework (RMF – SP800-37 Rev2), Security and

Privacy Controls Catalog (SP800-53 Rev5 and SP800-53B)

• Strategies for leveraging government initiatives, like cybersecurity hygiene, EINSTEIN, TIC, MTIPS, CDM, HBSS and ACAS solutions

• How to influence your organization’s planning, programming, and budget processes

• Potential strategies for effectively meeting the new FISMA requirements

• Methods for reducing the amounts of resources and paperwork

• New opportunities for innovative processes, controls, products and services necessary to support these

Presidential and NIST changes

The intended audience for the course is for Federal Agency, DoD and Intelligence employees and contractors:

• Authorization Officers (AOs), Inspector Generals (IGs)

• Senior Accountable Official for Risk Management (SAORM)

• Chief Information Officers (CIOs), Chief Financial Officers (CFOs), Chief Operations Officers (COOs), Chief Security Officers (CSOs)

• Business/Mission Owners, Program and Systems Managers (PMs and SMs)

• Senior Information Security Officers / Chief Information Security Officers ((SISOs/CISOs)

• Information System Owners, Common Control Providers (CCPs) and Information Owners

• Senior Agency Official for Privacy (SAOP) / Chief Privacy Officer (SAOP/CPO),

• Chief Acquisition Officer (CAO) and Enterprise Architect

• Information System Security Managers (ISSMs)

• Information System Security and Privacy Engineers (ISSEs, SSEs, and SPEs)

• System Security and Privacy Officers (ISSOs, SSO and SPOs)

• Security Control Assessors (SCAs and CAs)

• System Administrators (SysAdm)

• Product and Service Providers, Consultants, Integrators and Supporting Contractors

• Cybersecurity Professionals

• Supporting staff members

Unatek, Inc. GSA Multiple Award Schedule

6. Certified Ethical Hacker (CEH)

Length: 5 days course

This is the worlds most advanced ethical hacking course with 18 of the most current security domains any ethical hacker will ever want to know when they are planning to beef up the information security posture of their organization. In 18 comprehensive modules, the course covers over 270 attack technologies, commonly used by hackers.

The CEH v9 contains over 140 labs which mimic real time scenarios in the course to help you “live” through an attack as if it were real and provide you with access to over 2200 commonly used hacking tools to immerse you into the hacker world.

As “a picture tells a thousand words”, the developers of the CEH v12 have all this and more for you in over 2200 graphically rich, specially designed slides to help you grasp complex security concepts in depth which will be presented to you in 5 day hands on class by our Certified Instructor.

The goal of this course is to help you master an ethical hacking methodology that can be used in a penetration testing or ethical hacking situation. You walk out the door with ethical hacking skills that are highly in demand, as well as the globally recognized Certified Ethical Hacker certification! This course prepares you for EC-Council

Certified Ethical Hacker exam 312-50.

The Certified Ethical Hacker (CEH) program is the core of the most desired information security training system any information security professional will ever want to be in. The CEH, is the first part of a 3-part EC-Council

Information Security Track which helps you master hacking technologies. You will become a hacker, but an ethical one!

As the security mindset in any organization must not be limited to the silos of a certain vendor, technologies or pieces of equipment, this course was designed to provide you with the tools and techniques used by hackers and information security professionals alike to break into an organization. As we put it, “To beat a hacker, you need to think like a hacker”. This course will immerse you into the Hacker Mindset so that you will be able to defend against future attacks. It puts you in the driver’s seat of a hands-on environment with a systematic ethical hacking process.

Here, you will be exposed to an entirely different way of achieving optimal information security posture in their organization; by hacking it! You will scan, test, hack and secure your own systems. You will be thought the Five

Phases of Ethical Hacking and thought how you can approach your target and succeed at breaking in every time!

The five phases include Reconnaissance, Gaining Access, Enumeration, Maintaining Access, and covering your tracks.

The tools and techniques in each of these five phases are provided in detail in an encyclopedic approach to help you identify when an attack has been used against your own targets. Why then is this training called the Certified Ethical

Hacker Course? This is because by using the same techniques as the bad guys, you can assess the security posture of an organization with the same approach these malicious hackers use, identify weaknesses and fix the problems before they are identified by the enemy, causing what could potentially be a catastrophic damage to your respective organization.

Throughout the CEH course, you will be immersed in a hacker's mindset, evaluating not just logical, but physical security.

Unatek, Inc. GSA Multiple Award Schedule

Topics Covered:

1. Introduction to Ethical Hacking

2. Footprinting and Reconnaissance

3. Scanning Networks

4. Enumeration

5. System Hacking

6. Malware Threats

7. Sniffing

8. Social Engineering

9. Denial of Service

10. Session Hijacking

11. Hacking Web Servers

12. Hacking Web Applications

13. SQL Injection

14. Hacking Wireless Networks

15. Hacking Mobile Platforms

16. Evading IDS, Firewalls, and Honeypots

17. Cloud Computing

18. Cryptograph

• Auditors

• Network Administrators

• Firewall Administrators

• Security Professionals

• Anyone who is concerned about the integrity of the network infrastructure

Prerequisites

• Strong knowledge of TCP/IP

• Information systems and security background

• Minimum of 12 months of experience in networking technologies

Courseware Official Certified Ethical Hacker Courseware

Unatek, Inc. GSA Multiple Award Schedule

7. Certified Information Systems Security Professional (CISSP) Length: 5 day(s)

(ISC)²'s Certified Information Systems Security Professional (CISSP) certification is for information assurance professionals who define the architecture, design, management and/or controls that assure the security of business environments. This certification covers critical topics in security today, including risk management, cloud computing, mobile security, application development security and more. This vast breadth of knowledge and the experience it takes to pass the exam is what sets the CISSP apart.

1. Gain a comprehensive understanding of the 8 domains outlined in the CISSP CBK.

2. Acquire the knowledge and skills needed to pass the CISSP certification exam.

3. Understand the latest security trends and practices in the industry.

4. Apply practical insights and strategies for test-taking.

Topics Covered Include

• Security and Risk Management

• Asset Security

• Security Architecture and Engineering

• Communication and Network Security

• Identity and Access Management (IAM)

• Security Assessment and Testing

• Security Operations

• Software Development Security

The CISSP is designed for experienced IT security practitioners, managers, and executives who are interested in proving their skills and knowledge across a wide array of cybersecurity practices and principles.

Prerequisites:

• CISSPs are expected to be skilled and knowledgeable in security policy development and management and security controls across all disciplines within information security.

Unatek, Inc. GSA Multiple Award Schedule

8. Certified Cloud Security Professional (CCSP) Length: 5 day(s)

The Certified Cloud Security Professional (CCSP) training program and CCSP certification were created for both professionals and organizations who are interested in validating their cloud security capabilities. More specifically, the CCSP training program will prove you have the knowledge and hands-on experience with cloud security architecture, design, operations and service orchestration. The five-day CCSP training course will help you develop the necessary knowledge and skills to face new cloud computing threats and challenges. It will also help you prepare for the CCSP certification exam offered by (ISC)². Students review all six of the CCSP domains and gain a wealth of current information on the (ISC)² Common Body of Knowledge (CBK) for the CCSP exam.

1. Gain a comprehensive understanding of the 8 domains outlined in the CCSP CBK.

2. Acquire the knowledge and skills needed to pass the CCSP certification exam.

3. Understand the latest security trends and practices in the industry.

4. Apply practical insights and strategies for test-taking.

• Cloud Concepts, Architecture and Design

• Cloud Data Security

• Cloud Platform and Infrastructure Security

• Cloud Application Security

• Cloud Security Operations

• Legal, Risk and Compliance

The CCSP is ideal for IT and information security leaders responsible for applying best practices to cloud security architecture and design (Domain 1), data security (Domain 2), platform and infrastructure security (Domain 3), application security (Domain 4), security operations (Domain 5), and legal, risk and compliance (Domain 6).

For example, professionals in the following positions should consider adding the credential to their portfolio:

• Enterprise architect

• Security administrator

• Systems engineer

• Security architect

• Security consultant

• Security engineer

• Security specialist

• Systems architect

Prerequisites:

• CCSPs are expected to be skilled and knowledgeable in cloud security policy development and management and security controls across all disciplines within information security.

Unatek, Inc. GSA Multiple Award Schedule

9. Cybersecurity Training

The course provides an in-depth look at the current Cybersecurity landscape and the associated risk management methods used to combat threats. The course will enable students to understand security threats, information security risks and the strategies to maintain data security.

Upon completion of the course, you will master the following skills:

• Ability to evaluate, analyze and conduct enterprise risk management

• Identify vulnerabilities and implement mitigation

• Gain proficiency in different aspects of Cybersecurity

• Implement enterprise security policies

This course includes coverage of security threats, hardening systems, securing networks, cryptography and organizational security policies and understanding of Cyber Crime, intrusion, detection, and prevention applications, along with the Design and Evaluation of security architecture.

Anyone who wants a head start on Cybersecurity.

Unatek, Inc. GSA Multiple Award Schedule

10. Domain Name System

This course will introduce to students the fundamental concepts of DNS and BIND. Upon completion of the course students will gain an understanding of DNS and BIND Software Suite, BIND Configuration, DNS Troubleshooting, DNS Vulnerabilities, DNSSEC Concepts & terminology, the threat models that DNSSEC is intended to address, the benefits of DNSSEC and some of the operational and legal implications of DNSSEC.

This course provides students with not only a clear understanding

• Of how the signing process works

• Background about hashing algorithms and digital signatures.

• Differences between ZSK (zone signing keys) and KSK (key signing keys)

• How to operate a signed zone in bind.

• The chain of trust. How Your zone information is secured all the way back to the root

This course includes coverage of the following:

• Introduction to DNS

• DNS Vulnerabilities

• Introduction to Cryptography

• Introduction to DNSSEC

• New Resource Records for DNSSEC

• Delegating Signing Authority

• Setting up a Secure

• Flags and Scenarios

• Key Rollovers

• DANE

• Troubleshooting

G

Who Should Attend?

• Networking engineers who operate their own DNS-servers with bind

• Security aware people who want to understand DNSSec

• CCNA/CCNP students.

Unatek, Inc. GSA Multiple Award Schedule

11. CompTIA Security+ Training

CompTIA Security+ is the certification globally trusted to validate foundational, vendor-neutral IT security knowledge and skills. As a benchmark for best practices in IT security, this official course helps students prepare to write the actual CompTIA Security+ certification which covers the essential principles for network security and risk management – making it an important stepping stone to an IT security career. The training and course material for this official Security+ training program will provide students with a comprehensive review of network security, compliance and operation security, threats and vulnerabilities as well as application, data and host security.

Additionally, this course will also help students successfully prepare for the CompTIA Security+ exam.

This course includes coverage of the following common vulnerability areas:

• General Security Concepts

• Threats, Vulnerabilities & Mitigations

• Security Architecture

• Security Operations

• Security Program Management & Oversight

The CompTIA Security+ course will validate that the successful student has the knowledge and skills required to install and configure systems to secure applications, networks, and devices; perform threat analysis and respond with appropriate mitigation techniques; participate in risk mitigation activities; and operate with an awareness of applicable policies, laws, and regulations. The successful student will perform these tasks to support the principles of confidentiality, integrity, and availability.

• IT professionals with two years of experience in IT administration with a security focus, or equivalent training, looking to start or advance a career in security.

• Security Officers

• Security Managers

• System Administrators

• Network Administrators

Unatek, Inc. GSA Multiple Award Schedule

AUTHORIZED GSA FSS TRAINING SCHEDULE PRICELIST

Course Duration (Days) Price/Rate (Per Person)

(Onsite/Offsite) QA Security Testing Training 3 Days

$2,360.00 Secure Development and Secure Cloud Training

3 Days

$2,360.00 Web Application Penetration Testing Training

2 Days $1,735.50

Mobile Application Penetration Testing Training

2 Days $1,735.50

FISMA Training 2 Days $1,406.00

Certified Ethical Hacker 5 Days $3,439.14

CISSP 5 Days $1,407.65

CCSP 5 Days $2,246.25

Cybersecurity Training 2 Days $962.50

Domain Name System Training 5 Days $1,339.50

CompTIA Security+ 5 Days $984.00

Unatek, Inc. GSA Multiple Award Schedule

DESCRIPTION OF LABOR CATEGORIES AND PRICING FOR SPECIAL ITEM

NUMBER 54151HACS

(Highly Adaptive Cybersecurity Services (HACS))

1. DESCRIPTION OF LABOR CATEGORIES

The following is the description of the labor categories:

Commercial Labor Category

Min Experience Education Functions

Penetration Testing Engineer

5 Bachelors Perform scoping of penetration tests, use cases, and timing penetration testing engagements. Develop “rules of engagement’ with partners Internal and external network penetration testing.

Conduct systems, network and application testing, including black box, code reviews, and reverse engineering, software development.

Perform In-vehicle, network and software architecture reviews and guidance. Develop and communicate recommendations on findings remediation. Perform activities associated with continuous improvement of testing processes and methodologies. Coordinate and function as a subject matter expert to third-party penetration testing efforts, as needed.

Vulnerability Management Engineer

3 Bachelors Conduct scoping of vulnerability tests, use cases, and timing vulnerability testing engagements. Develop “rules of engagement’ with partners Internal and external network vulnerability testing.

Conduct systems, network and application testing, including black box, code reviews, and reverse engineering, software development. Perform In-vehicle, network and software architecture reviews and guidance. Develop and communicate recommendations on findings remediation. Perform activities associated with continuous improvement of testing processes and methodologies. Coordinate and function as a subject matter expert to third-party vulnerability testing efforts, as needed.

DNS Engineer 5 Bachelors Deploy, maintain, and troubleshoot Domain Name Systems (DNS).

Conduct DNS vulnerability assessment tools, event and log analysis, security change tracking and other DNS network security systems and devices. Review requests for increased DNS network access and provide risk-analysis. Deliver, maintain and improve DNS security awareness training. Coordinate with business and development teams to further integrate security into application and product designs. Research and design solutions to DNS technical and business problems.

Technical Lead 8 Bachelors Responsible for defining the technical approach and development strategy for technology projects. Meets with end users and developers to capture requirements and define the scope of projects. Prepares requirements and design specification documentation. Recommend development strategies which take

Unatek, Inc. GSA Multiple Award Schedule into account the requirements, operating system, hardware and software constraints. Proficient in a variety of security tools.

Advanced knowledge and use of Case Tools, e-Business, Software Security Architectures, Quality Assurance and Project LifeCycles.

Provides technical guidance and support to team members.

Senior Information Security Engineer

8 Bachelors Under the Supervision of a Program Manager or Director. Able to provide day-to-day IT security expertise for multiple projects without supervision. Provide technical team management for Information Security Engineers. Acts as a bridge between senior program/project management and the technical team. Duties include supervising IT security team, developing and maintaining security rules and providing security training to ISO staff as needed; installing, configuring and maintaining the security infrastructure (RSA servers, Firewalls, IDS, VPN); and managing vendor relationships. Assesses security risks, identifies and recommends effective solutions, and consults with operations or business units when necessary. Improves security infrastructure through internal assessments, identification of vulnerabilities, and managing corrective actions. Identifies and implements missing key security program elements such as security policies, standards, guidelines, patch policy, Computer Incident Response Team procedures. Design the architecture of the Information Assurance system, working closely with the Program Security Manager, Systems Engineering, and Software Engineering to synthesize security requirements into systems which can be certified and which meet customer requirements. Implements IT Security Architecture and set all policies and procedures.

Interfaces with business units to understand the risks and address their needs. Compares new Security Architectures to NIST, ISO 17799, etc. Assists with the investigation of security breaches and assist with disciplinary and legal matters associated with such breaches as necessary. Works effectively across a large information security team, understanding the larger team’s role (network, platform and monitoring) in the overall security strategy of the firm.

Information Security Engineer

5 Bachelors Under the Supervision of a Senior Security Engineer. Provides day-to-day IT security expertise for multiple projects. Duties include developing and maintaining security rules and providing security training to ISO staff as needed; installing, configuring and maintaining the security infrastructure (RSA servers, Firewalls, IDS, VPN); and managing vendor relationships. Performs risk assessments and security testing as part of a security engineering team. Analyzes system security on a variety of information systems, network devices (firewalls, routers, and switches), web server and database applications. Supports the certification and accreditation process for IT systems and networks including preparation of key documentation and planning and conducting security tests and evaluations, analytical and systems engineering for development of strategic plans and security architectures for government activities. Develops and/or analyzes information systems security requirements. Consult with the application development teams on application security requirements, including key SMD applications that use single sign-on and common database(s), analyze potential security problems and take appropriate corrective action. Supports adapting, interpreting, and/or developing INFOSEC policy; performing site security compliance reviews and site surveys; and providing security

Unatek, Inc. GSA Multiple Award Schedule awareness training. Will participate and perform compliance reviews of field activities.

Senior Security Engineer 5 Bachelors Deploy, maintain, and troubleshoot firewalls, Intrusion Detection, VPN appliances, vulnerability assessment tools, event and log analysis, security change tracking and other network security systems and devices. Review requests for increased network access and provide risk-analysis. Deliver, maintain and improve security awareness training. Coordinate with business and development teams to further integrate security into application and product designs. Research and design solutions to technical and business problems.

Information Security Consultant

8 Bachelors Possesses advanced level knowledge and experience in information security and/or relevant information technology best practices and standards with a heavy concentration on solving customer security challenges. Performs project tasks with little or no supervision. Leads teams on large scale projects. Contributes a significant piece of a project deliverable. Possess ability to create detailed, professional documentation to be delivered to client and is able to create and recommend remediation for components of security policies. Provides specific recommendations for a clients business or technical issues. (Example: Lack of or enforcement of a password policy.). Understands one or more regulatory areas including, but not limited to: PCI (Visa CISP, MasterCard SDP, Discover DISC, and Amex DSOP), ISO 17799/BS 7799, GLBA, HIPAA, and SOX. Understands the creation, management, and oversight of Information Security Programs, Business Continuity Planning and Change Control functions for Information Services.

Familiarity with retail information security challenges.

Senior Network Security Engineer

5 Bachelors Deploy, maintain, and troubleshoot firewalls, Intrusion Detection, VPN appliances, vulnerability assessment tools, event and log analysis, security change tracking and other network security systems and devices. Review requests for increased network access and provide risk-analysis. Deliver, maintain and improve security awareness training. Coordinate with business and development teams to further integrate security into application and product designs. Research and design solutions to technical and business problems

Network Security Engineer

5 Bachelors Provides Network and Cyber Security protection of information systems including protection of security devices such as intrusion detection and prevention systems, firewalls and virtual private network equipment. Assist in proffering such other solutions necessary to protect their network assets from both internal and external breaches. Provides technical security expertise and guidance to architecture, network and application teams and projects for identification of security issues and requirements.

Senior Certification & Accreditation (C&A)

Engineer

3 Bachelors Provides technical services to ensure the systems are designed to meet C&A and IA requirements and are properly certified and accredited. Develops or recommends integrated security system and physical control solutions that will ensure proprietary/confidential data and systems are protected. Provides technical engineering services for the support of integrated security systems and solutions to manage information-related risks. Participates with the client in the strategic design process to translate security and business requirements into technical designs. Configures and validates secure systems and physical controls, and tests security products and systems to detect security weakness.

Unatek, Inc. GSA Multiple Award Schedule

Certification & Accreditation (C&A)

Engineer

3 Bachelors Provides technical support in the creation and delivery of technology solutions. Responsible for the consolidation and audit of technical documentation needed to receive systems or solution certification & accreditation. Responsible for the presentation of technical document to internal and external customers. Acts as a facilitator between certification & accreditation entities and solution engineering. Responsible for analyzing performance problems and recommends solutions to enhance functionality, reliability and/or usability.

Provides technical engineering services for the support of integrated security systems and solutions to manage information-related risks. Participates with the government in the strategic design process to translate security and business requirements into technical designs. Configures and validates secure systems and physical controls, and tests security products and systems to detect security weakness. Prepares Security Accreditation documentation.

Risk Assessment /Analyst Engineer

5 Bachelors Under supervision, analyzes security risks inherent in Hardware, Software and Communication systems. Assesses security risks, identifies and recommends effective solutions, and consults with operations or business units when necessary. Identifies and implements missing key security program elements such as security policies, standards, guidelines, patch policy, Computer Incident Response Team procedures. Analyzes user requirements designs and security elements of an application. Assists in preparation of requirements and design documents. Able to analyze data and object models security risks. Facilitate and documents software requirements. Perform risk analysis of network and application systems using a variety of Risk Assessment tools. Communicates technical information to team members and end-users. Designs systems amd network security remediation to meet analysis requirements. Establishes rapport with customer security organizations and communicate and translate requirements to find best fit solutions for customers.

Performs and updates impact analysis reports for customer specified requirements against system architecture/design.

Participates in the Test Program to ensure that security controls are properly planned and implemented. Evaluates changes to system software or hardware for impact to security.

Security Architect 8 Bachelors The Security Architect II is expected to be an expert in a broad range of security disciplines and must be well versed in a broad spectrum of technology areas. The Security Architect is responsible for leading the development of security technology plans/roadmaps that address current state challenges and how to achieve a target future state. The Security Architect may also participate as a Solution Architect for high priority, strategic IT security projects.

In addition, this role will lead security technology evaluation and selection activities and will define and develop security services, standards, reference architectures, assets and frameworks required to support T-Mobiles business strategy. The Security Architect will serve as point of escalation, review and approval for key issues, significant security projects and decisions.

Configuration Manager 8 Bachelors Provide project level support including compiling the necessary procedures, policies and processes for establishing and maintaining integrity in software baselines. Document standard

Unatek, Inc. GSA Multiple Award Schedule configuration management processes and procedures to include:

version control, build and release management, SCM audit reports, configuration identification and control, software product baselines, change management, tracking and reporting in a controlled and methodical SCM environment.

Senior Business Analyst 5 Bachelors Translate business and data needs into system requirements for designers, developers and testers using requirements elicitation, analysis, specification, verification and management techniques.

Also analyze business processes for technical implementations and managing document management related projects.

Business Analyst 5 Bachelors Collect business and data needs into system requirements for designers, developers and testers using requirements elicitation, analysis, specification, verification and management techniques.

Elicit business processes requirements for technical implementations and managing document management related projects.

Comp/Te…