MAS - Identity Theft Guard Solutions, Inc. - GS23F0037T

IDX GS-23F-0037T January 2024

U.S. GENERAL SERVICES ADMINISTRATION

Federal Acquisition Service

Authorized Federal Supply Schedule FSS Price List Pricelist current through Modification #PS-0086, dated 01/01/2024

For more information on ordering go to the following website:

https://www.gsa.gov/schedules

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create and electronic delivery order are available through GSA Advantage!, a menu-driven database system at GSAAdvantage.gov.

Multiple Award Schedule

Code H: Professional Services H01. Business Administrative Services Subcategory H04. Identity Protection Services Subcategory

Contract Number: GS-23F-0037T Business Size: Large

Contract Period: March 26, 2022 – March 25, 2027

Identity Theft Guard Solutions, Inc. dba IDX 4145 SW Watson Avenue, Suite 400 Beaverton, OR 97005 Tel: 800-298-7558, FAX: 410-630-5766

Website: https://www.idx.us

Email: gov@zerofox.com

Contacts: Dan Smith, SVP Federal (703)283-0145

Ian Kelly, SVP Breach Response Solutions (971)242-4716

About IDX

At IDX, we provide innovative software and services to organizations for managing cyber risks and data breaches, and to consumers to protect and restore their identities from identity theft.

Founded in 2003, IDX has served many of the largest healthcare, financial services, retail, higher education, and government organizations in the

United States. Millions of

Americans use our flagship MyIDCare identity protection service to safeguard their personal information.

https://www.idx.us/ mailto:gov@zerofox.com

Customer Information

1a. Table of Award Special Item Number(s):

SIN Recovery SIN Description

561450 561450RC Business Information Services (BIS)

541990IPS 541990IPSRC Data Breach Response and Identity Protection

OLM OLMRC Order-Level Materials (OLMs)

1b. Identification of the lowest priced model number and lowest unit price for that model for each special item number awarded in the contract. This price is the Government price based on a unit of one, exclusive of any quantity/dollar volume, prompt payment, or any other concession affecting price.

Those contracts that have unit prices based on the geographic location of the customer, should show the range of the lowest price, and cite the areas to which the prices apply: See GSA Price List on pages 10-11.

1c. If the Contractor is proposing hourly rates a description of all corresponding commercial job titles, experience, functional responsibility and education for those types of employees or subcontractors who will perform services shall be provided. If hourly rates are not applicable, indicate “Not applicable” for this item: Not Applicable.

2. Maximum Order: $1,000,000

3. Minimum Order: $100

4. Geographic Coverage: Domestic

5. Point(s) of production: Same as company address

6. Discount from list prices or statement of net price: Government Net Prices (discounts already deducted).

7. Quantity discounts: None

8. Prompt payment terms. Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions: Net 30 Days.

9. Foreign items: Not Applicable

10a. Time of delivery: Contact Contractor

10b. Expedited Delivery: Not Applicable

10c. Overnight and 2-day delivery: Not Applicable

10d. Urgent Requirements: Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

11. F.O.B. destination: Destination

12a. Ordering address: 4145 SW Watson Avenue, Suite 400, Beaverton, OR 97005

12b. Ordering procedures: See Federal Acquisition Regulation (FAR) 8.405-3

13. Payment address: 4145 SW Watson Avenue, Suite 400, Beaverton, OR 97005

14. Warranty provision: Not Applicable

15. Export packing charges: Not Applicable

16. Terms and conditions of rental, maintenance and repair: Not Applicable

17. Terms and conditions of installation: Not Applicable

18a. Terms and conditions of repair parts indicating date of parts price lists and any discounts from list prices: Not Applicable

18b. Terms and conditions for any other services: Not Applicable

19. List of service and distribution point(s): 4145 SW Watson Avenue, Suite 400, Beaverton, OR 97005

20. List of participating dealers: Not Applicable

21. Preventative maintenance: Not Applicable

22a. Special attributes such as environmental attributes (e.g., recycled content, energy efficient, and/or reduced pollutants): Not Applicable

22b. Section 508 Compliance: Not Applicable

23. Unique Identifier (UEI) number: W87HKT8TQJP5

24. Notification regarding registration in the System for Award Management database: IDX is registered in SAM.

Services Contract Labor Standards (SCLS): The Service Contract Labor Standards, formerly the Service Contract Act (SCA), apply to this contract, as it applies to the entire Multiple Award Schedule and all services provided. While no specific labor categories have been identified as being subject to SCLS due to exemptions for professional employees (FAR 22.1101, 22.1102 and 29 CFR 541.300), this contract still maintains the provisions and protections for SCLS eligible labor categories. If and/or when the Contractor adds SCLS labor categories / employees to the contract through the modification process, the Contractor must inform the Contracting Officer and establish a SCLS matrix identifying the GSA labor category titles, the occupational code, SCLS labor category titles and applicable wage determination (WD) number. Failure to do so may result in cancellation of the contract.

IDX Service Descriptions for All SINs

Total Solution Identity Protection Package – Per Impacted Individual Per Year (see Table 1 for Total Solution Pricing and Table 3 for Line Item Pricing)

IDX Identity is the most comprehensive identity protection solution available. IDX offers an identity protection package that addresses various types of identity theft risk, along with the support needed to restore identities to pre-theft status and insurance. Price Per Year, Per Impacted Individual pricing may be used by the Ordering Agency when the enrollment rate of the breach is unknown or Ordering Agency desires to provide coverage of various services, e.g. Identity Theft Insurance and Identity Restoration Services, to the entire impacted population regardless of enrollment status. The Total Solution includes comprehensive identity protection services delivered via the IDX customizable and configurable MyIDCare service delivery platform. The package includes:

• Website and Web Application - Dedicated, branded website and web app. for enrollment, monitoring, alerts and access to all data breach response services procured by the ordering Agency. A dedicated URL is created for each engagement.

• 24/7 Call Center – Established call center with service specialists readily available to assist 24 hours a day, 7 days a week by dialing a U.S. toll-free number dedicated to your Agency. Our agents, located in the U.S., speak both English and Spanish and are always up-to-date with the latest information, ready to assist with enrollment, assist with alerts or respond to any questions the caller may have.

• Notification - Provides the procuring Agency with a well-orchestrated and stress-free notification process which includes:

o Printing, processing and handling of U.S.P.S. First Class notification letter to affected population o Acceptance of secured data feed with name, address and unique ID to validate affected population and integrate with CRM system o National Change of Address (NCOA) validation prior to mailing o Return mail management o Researching undeliverable letters and managing process for resending

• Credit Monitoring Services – Monitors, informs and alerts the enrollee to credit file activity that could affect their score or signal that their identity may have been compromised, includes:

o Tri-Bureau credit report from Experian, Transunion and Equifax upon enrolment o Tri-Bureau credit report monitoring - alerts to suspicious or abnormal activity o Credit limit alerts – credit card limit increases/decreases by more than $100 o Credit utilization alerts – credit utilized increases/decreases by more than 30% from last reported o Credit balance alerts – credit balance increases/decreases by more than $5,000 o Dormant account alerts – alerts to accounts that have zero balance for more than six months o Positive activity alerts - notifies when improvements have occurred to credit report which may have a positive impact on credit score o Real-time credit inquiry/authorization alerts – alerts within moments of a hard inquiry o Credit score change alerts – alerts to changes in credit score, allows enrollee to adjust alert type and sensitivity o Other useful on-demand information, tools and services such as:

• Credit file lock/unlock – enrollee initiated locking and unlocking of credit file that blocks extensions of credit and other inquiries that result in opening of new bank, credit and utility accounts

• Single bureau credit report – enrollee initiated pulling of credit report

• Real-time credit score – credit score displayed on MyIDCare dashboard

• Credit score tracking – plots score over time on a graph for easy visualization of changes over time

• Identity Monitoring Services – Monitors the internet, dark web and various public records and other databases 24/7, and alerts the enrollee of changes to personal information, includes, o Cyber/dark web monitoring - monitors thousands of websites and millions of data points and alerts if personal information is found bought or sold online, including bank accounts, social security number, phone numbers, email addresses, credit and debit card numbers, health insurance identification numbers, driving license, passport number o Financial account creation and takeover monitoring – alerts to new credit cards, bank accounts or changes to existing bank accounts o Address change monitoring – alerts to mail being redirected through the U.S.

postal service o Court and public record monitoring – tracks arresting agencies and municipal court system and alerts to new records filed under your name o Payday (small) loan monitoring – monitors online, rent-to-own and payday lender storefronts to detect if a non-credit loan has been opened o Sex offender monitoring – alerts to sex offenders moving in close by or if a sex offender is registered using enrollees address o SSN trace and monitoring – provides a report of all names and aliases associated with enrollee’s SSN and alerts to new names or aliases o Child monitoring – monitors for signs you children’s personal information is being bought or sold online o Lost wallet protection – provides support in cancelling and reissuing PII that could become compromised

• Identity Theft Insurance - Identity Theft Insurance will reimburse Impacted Individuals, regardless of their enrollment status, for expenses associated with restoring their identity should they become a victim of identity theft. If an Impacted Individual’s identity is compromised, the policy provides coverage for up to $5,000,000, with no deductible, subject to the terms, limits and/or exclusions of the policy.

• Identity Restoration – Regardless of an Impacted Individuals enrollment status, should an individual detect fraudulent activity, or suspect they are a victim of identity theft within the period of performance, IDX investigates and if they are in fact a victim of identity theft, restores the individual’s identity to the pre-compromised state.

• Reports – Customized reports based on the needs of the Ordering Agency as defined in the task order, to include statistics such as: website operational status and number of times accessed, number of enrollments, utilization of services, and customer feedback.

• System Security Plan, Administration and Reporting as required by GSA, such as, Security and Security Related Reporting, Post Award Data Incident Reporting, Required Reports, Data Safeguard and Disposal, Task Order Award Reporting.

Total Solution Identity Protection Package – Per Enrollee Per Year (see Table 2 for

Total Solution Pricing and Table 4 for Line Item Pricing)

IDX Identity is the most comprehensive identity protection solution available. IDX offers an identity protection package that addresses various types of identity theft risk, along with the support needed to restore identities to pre-theft status and insurance. Price Per Year, Per Enrollee pricing may be used by the Ordering Agency when the number of individuals requiring services is known. The Total Solution includes comprehensive identity protection services delivered via the IDX customizable and configurable MyIDCare service delivery platform. Pricing includes all services as required and described herein but services are ONLY applicable and delivered to Enrollees. The package includes:

• Website and Web Application - Dedicated, branded website and web app. for enrollment, monitoring, alerts and access to all data breach response services procured by the ordering Agency. A dedicated URL is created for each engagement.

• 24/7 Call Center – Established call center with service specialists readily available to assist 24 hours a day, 7 days a week by dialing a U.S. toll-free number dedicated to your Agency.

Our agents, located in the U.S., speak both English and Spanish and are always up-to-date with the latest information, ready to assist with enrollment, assist with alerts or respond to any questions the caller may have.

• Notification - Provides the procuring Agency with a well-orchestrated and stress-free notification process which includes:

o Printing, processing and handling of U.S.P.S. First Class notification letter to affected population o Acceptance of secured data feed with name, address and unique ID to validate affected population and integrate with CRM system o National Change of Address (NCOA) validation prior to mailing o Return mail management o Researching undeliverable letters and managing process for resending

• Credit Monitoring Services – Monitors, informs and alerts the enrollee to credit file activity that could affect their score or signal that their identity may have been compromised, includes:

o Tri-Bureau credit report from Experian, Transunion and Equifax upon enrolment o Tri-Bureau credit report monitoring - alerts to suspicious or abnormal activity o Credit limit alerts – credit card limit increases/decreases by more than $100 o Credit utilization alerts – credit utilized increases/decreases by more than 30% from last reported o Credit balance alerts – credit balance increases/decreases by more than $5,000 o Dormant account alerts – alerts to accounts that have zero balance for more than six months o Positive activity alerts - notifies when improvements have occured to credit report which may have a positive impact on credit score o Real-time credit inquiry/authorization alerts – alerts within moments of a hard inquiry o Credit score change alerts – alerts to changes in credit score, allows enrollee to adjust alert type and sensitivity o Other useful on-demand information, tools and services such as:

• Credit file lock/unlock – enrollee initiated locking and unlocking of credit file that blocks extensions of credit and other inquiries that result in opening of new bank, credit and utility accounts

• Single bureau credit report – enrollee initiated pulling of credit report

• Real-time credit score – credit score displayed on MyIDCare dashboard

• Credit score tracking – plots score over time on a graph for easy visualization of changes over time

• Identity Monitoring Services – Monitors the internet, dark web and various public records and other databases 24/7, and alerts the enrollee of changes to personal information, includes, o Cyber/dark web monitoring - monitors thousands of websites and millions of data points and alerts if personal information is found bought or sold online, including bank accounts, social security number, phone numbers, email addresses, credit and debit card numbers, health insurance identification numbers, driving license, passport number o Financial account creation and takeover monitoring – alerts to new credit cards, bank accounts or changes to existing bank accounts o Address change monitoring – alerts to mail being redirected through the U.S.

postal service o Court and public record monitoring – tracks arresting agencies and municipal court system and alerts to new records filed under your name o Payday (small) loan monitoring – monitors online, rent-to-own and payday lender storefronts to detect if a non-credit loan has been opened o Sex offender monitoring – alerts to sex offenders moving in close by or if a sex offender is registered using enrollees address o SSN trace and monitoring – provides a report of all names and aliases associated with enrollee’s SSN and alerts to new names or aliases o Child monitoring – monitors for signs you children’s personal information is being bought or sold online o Lost wallet protection – provides support in cancelling and reissuing PII that could become compromised

• Identity Theft Insurance - Identity Theft Insurance will reimburse Enrollees, for expenses associated with restoring their identity should they become a victim of identity theft. If an Impacted Individual’s identity is compromised, the policy provides coverage for up to $5,000,000, with no deductible, subject to the terms, limits and/or exclusions of the policy.

• Identity Restoration – Should an Enrollee detect fraudulent activity, or suspect they are a victim of identity theft within the period of performance, IDX investigates and if they are in fact a victim of identity theft, restores the individual’s identity to the pre- compromised state.

• Reports – Customized reports based on the needs of the Ordering Agency as defined in the task order, to include statistics such as: website operational status and number of times accessed, number of enrollments, utilization of services, and customer feedback.

• System Security Plan, Administration and Reporting as required by GSA, such as, Security and Security Related Reporting, Post Award Data Incident Reporting, Required Reports, Data Safeguard and Disposal, Task Order Award Reporting.

Additional Services (see Table 5 for per Enrollee pricing)

IDX provides the following customized services that agencies can order in addition to the IPS requirements.

• Medical Transaction Monitoring and Alerts – Monitors and alerts to transactions involving medical identity and health insurance numbers that may signal that an Enrolled Individual’s medical identity has been compromised. Enrolled Individuals receive an alert each time a medical or health insurance transaction is processed under their identity. This service can help Enrolled Individuals in gaining better control of their medical identity to combat one of the fastest-growing crimes in the U.S. – medical identity theft.

• ForgetMe Personal Data Remover – Looks for the enrollees personal identifying information for sale on the Web and starts an automatic removal process.

• Advanced Address Locator – Uses SSNs or TINs to scour over 65 billion public records from over 10,000 sources within a single search to gather updated or alternate address information of Impacted Individuals.

• Social Media Monitoring - Alerts enrollees to privacy or reputational risks associated with content shared on their and their children’s social networks, including personal information, foul language, sexual content, drug/alcohol, weapons references and any content that may indicate instances of cyberbullying or sexual predator activity.

• Child Monitoring – Monitors a child's social security number and personal information on the dark web to identify potentially nefarious activity and to spot credit information associated with a child's identity.

• Offline Mailed Alternative – Allows Enrolled Individuals with the option of receiving credit or identity monitoring Alert notifications by mail (U.S. Postal Service) in addition to email.

• Non-branded Website - The non-branded IDX website has the same capabilities to enroll Impacted Individuals, deliver monitoring services and provide general information related to data breach and safeguarding PII/PHI, and meets all GSA required accessibility, security and performance standards.

• Native Mobile App – Allows Enrolled Individuals to access their MyIDCare account and receive and review alerts on their mobile device.

IDX GSA Schedule Pricing The rates shown below include the Industrial Funding Fee (IFF) of 0.75%.

Table 1: Total Solution Identity Protection Package for SIN 541990IPS Firm Fixed Price Per Year, Per Impacted Individual

Number of Impacted Individuals 3/26/23- 3/25/24

3/26/24- 3/25/25

3/26/25- 3/25/26

3/26/26- 3/25/27

1-25k $9.82 $10.03 $10.23 $10.43 over 25k to 250k $8.44 $8.61 $8.79 $8.96 over 250k to 1M $8.05 $8.21 $8.37 $8.54 over 1M to 10M $7.56 $7.71 $7.86 $8.02 over 10M to 20M $7.07 $7.21 $7.36 $7.51 over 20M $6.68 $6.81 $6.95 $7.09

Table 2: Total Solution Identity Protection Package for SIN 541990IPS Firm Fixed Price Per Year, Per Enrollee

Number of Enrollees

3/25/24

3/26/24- 3/25/25

3/26/25- 3/25/26

3/26/26- 3/25/27

1-25k $63.45 $64.72 $66.01 $67.32 over 25k to 250k $54.57 $55.66 $56.77 $57.90 over 250k to 1M $52.03 $53.07 $54.13 $55.20 over 1M to 10M $48.86 $49.83 $50.83 $51.85 over 10M to 20M $45.68 $46.60 $47.54 $48.48 over 20M $43.15 $44.02 $44.90 $45.79

Table 3: Line Item Pricing - SIN 541990IPS and 561450 Firm Fixed Price Per Year, Per Impacted Individual

Service Description

3/25/24

3/26/24- 3/25/25

3/26/25- 3/25/26

3/26/26- 3/25/27

Notification & Address Verification (price is per notification, includes postage)

$1.70 $1.73 $1.76 $1.80

24/7 Call Center $0.74 $0.75 $0.76 $0.78

Credit Monitoring Services $5.50 $5.61 $5.72 $5.83

Identity Monitoring Services $2.32 $2.37 $2.42 $2.47

$5 Million Identity Theft Insurance

$0.29 $0.30 $0.31 $0.32

Identity Restoration $0.65 $0.66 $0.68 $0.69

Table 4: Line Item Pricing - SIN 541990IPS and 561450

3/25/24

3/26/24- 3/25/25

3/26/25- 3/25/26

3/26/26- 3/25/27

Notification & Address Verification (price is per notification, includes postage)

$1.70 $1.73 $1.76 $1.80

24/7 Call Center $4.90 $5.00 $5.10 $5.20

Credit Monitoring Services $36.68 $37.41 $38.16 $38.92

Identity Monitoring Services $15.49 $15.80 $16.11 $16.43

$5 Million Identity Theft Insurance

$1.92 $1.96 $2.01 $2.05

Identity Restoration $4.37 $4.46 $4.55 $4.64

Table 5: Additional Services - SIN 541990IPS and 561450

3/25/24

3/26/24- 3/25/25

3/26/25- 3/25/26

3/26/26- 3/25/27

Medical Transaction Monitoring & Alerts

$3.10 $3.16 $3.22 $3.28

ForgetMe Personal Data Remover $4.30 $4.39 $4.48 $4.57

Advanced Address Lookup (price is per lookup)

$0.21 $0.21 $0.21 $0.21

Social Media Monitoring $2.99 $3.05 $3.11 $3.17

Child Identity Monitoring $19.98 $20.38 $20.79 $21.20

Offline Mailed Alternative $17.79 $18.15 $18.51 $18.88

Non-branded Website $0.00 $0.00 $0.00 $0.00