MAS - Gunnison Consulting Group, Inc. - GS35F0161Y

General Services Administration

Federal Acquisition Service Authorized Federal Supply Schedule (FSS) Price List

Online access to contract ordering information, terms and conditions, pricing, and the option to create an electronic delivery order are available through GSA Advantage!®. The website for GSA Advantage!® is: http://www.gsaadvantage.gov

Multiple Award Schedule (MAS) Contract Number: GS-35F-0161Y

Information Technology Large Category FSC Code: DA01

Gunnison Consulting Group, Inc.

8280 Willow Oaks Corporate Drive, Suite 600

Fairfax, VA 22031-4516 Phone: 703.346.1168

Fax: 888.428.4561 www.gunnisonconsulting.com

Contract Administrator: Sarwat Farooq, sfarooq@gunnisonconsulting.com

Phone: 703.996.4124

Contract Period: January 24, 2012 - January 23, 2027

Business Size: Other than Small Business

Prices shown herein are NET (discount deducted).

Pricelist current as of modification PS-0053 effective May 29, 2025

For more information on ordering go to the following website: https://www.gsa.gov/schedules.

http://www.gsaadvantage.gov/ http://www.grsi.com/ mailto:sfarooq@gunnisonconsulting.com https://www.gsa.gov/schedules

GS-35F-0161Y Page i

TABLE OF CONTENTS

CUSTOMER INFORMATION

CONTRACT OVERVIEW

CONTRACT ADMINISTRATOR

BRIEF COMPANY OVERVIEW

CONTRACT USE

CONTRACT SCOPE

SPECIAL ITEM NUMBER (SIN) DESCRIPTIONS

INSTRUCTIONS FOR PLACING ORDERS FOR SERVICES BASED ON GSA SCHEDULE HOURLY RATES

BLANKET PURCHASE AGREEMENT

LABOR CATEGORY DESCRIPTIONS

HOURLY RATES FOR SERVICES INCLUDING IFF

GS-35F-0161Y Page 1

CUSTOMER INFORMATION

1a. Table of Awarded Special Item Numbers (SINs):

Please refer to GSA eLibrary (www.gsaelibrary.gsa.gov) for detailed SIN descriptions

SIN SIN Title

54151HACS / 54151HACS STLOC / 54151HACS RC Highly Adaptive Cybersecurity Services (HACS) 54151HEAL / 54151HEAL RC / 54151HEAL STLOC Health Information Technology Services

54151S / 54151S RC / 54151S STLOC Information Technology Professional Services OLM / OLM RC / OLM STLOC Order-Level Materials (OLM)

1b. Lowest Priced Model Number and Lowest Price: Please refer to our rates beginning on page #34

1c. Labor Category Descriptions: Please refer to our descriptions beginning on page # 7

2. Maximum Order: SIN 54151HACS, SIN 54151HEAL and 54151S:

$ 500,000

SIN OLM: $ 250,000

The maximum order threshold represents the point where, given the dollar value of the potential order, the Schedule Contractor may decline the order. Schedule contractors are encouraged, but not obligated, to accept orders exceeding this limit.

3. Minimum Order: $ 100.00

4. Geographic Coverage: Domestic delivery only

5. Point of Production: 8280 Willow Oaks Corporate Drive, Suite 600

Fairfax, VA 22031-4516

6. Discount from List Price: All prices herein are net

7. Volume Discounts: • 1.0% volume discount on task orders with an initial funded value from $500,001-$999,999

• 2.0% volume discount on task orders with an initial funded value of at least $1,000,000

Volume discounts are not additive

8. Prompt Payment Terms: 1.0% 10, Net 30 days

Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions

9. Foreign Items: None

10a. Time of Delivery: As negotiated at the Task Order level

10b. Expedited Delivery:

Items available for expedited delivery are noted in this price list.

10c. Overnight and 2-Day Delivery:

Overnight and two-day deliverable may be available, please contact contractor for availability.

10d. Urgent Requirement:

Ordering agencies can request accelerated delivery for urgent requirements.

11. F.O.B. Point: Destination

12a. Ordering Address: Gunnison Consulting Group, Inc.

http://www.gsaelibrary.gsa.gov/

GS-35F-0161Y Page 2

Fairfax, VA 22031-4516

12b. Ordering Procedures: See Federal Acquisition Regulation (FAR) 8.405-3.

13. Payment Address: Gunnison Consulting Group, Inc.

Fairfax, VA 22031-4516

14. Warranty Provision: Not Applicable

15. Export Packing Charges: Not Applicable

16. Terms and conditions of rental, maintenance, and repair (if applicable):

Not Applicable

17. Terms and conditions of installation (if applicable):

18a. Terms and conditions of repair parts indicating date of parts, price lists and any discounts from list prices (if applicable):

Not Applicable

18b. Terms and conditions for any other services (if

19. List of service and distribution points (if

20. List of participating dealers (if applicable): Not Applicable

21. Preventative maintenance (if applicable) Not Applicable

22a. Special attributes such as environmental attributes (e.g., recycled content, energy efficiency, and/or reduced pollutants.):

Not Applicable

22b. If applicable, indicate that Section 508 compliance information is available on Information and Communications Technology (ICT) supplies and services and show where full details can be found (e.g. contractor’s website or other location.) The ICT standards can be found at: www.Section508.gov/

See www.gunnisonconsulting.com.

23. Unique Entity Identifier (UEI) Number: U17XQAKKMPT7

24. Gunnison Consulting Group, Inc. is registered in the System for Award Management (SAM).

http://www.section508.gov/ http://www.gunnisonconsulting.com/

GS-35F-0161Y Page 3

CONTRACT OVERVIEW

GSA awarded Gunnison Consulting Group, Inc. a GSA Multiple Award Schedule (MAS) contract under the Information Technology Large Category with contract number GS-35F-0161Y. The current option period is July 23, 2022 – January 23, 2027. GSA may exercise one additional five-year option period. The contract allows for the placement of Firm Fixed Price or Time and Materials task orders using the labor categories and ceiling rates defined in the contract.

CONTRACT ADMINISTRATOR

Sarwat Farooq, Director of Contracts Gunnison Consulting Group, Inc.

8280 Willow Oaks Corporate Drive, Suite 600 Fairfax, VA 22031-4516 Phone: 703.996.4124 Fax: 888.428.4561 Email: sfarooq@gunnisonconsulting.com

BRIEF COMPANY OVERVIEW

Since 1994, Gunnison Consulting Group has served the Federal Government by taking on its most ambitious technology projects. Our 25+ years of success are attributed to a culture dedicated to making the impossible possible. We collaboratively work with our customers to understand their requirements, and goals, and then bring to bear our domain expertise, industry knowledge, and partnerships to achieve those objectives.

With a winning combination of thought-leading innovation, industry certifications, and strong partnerships, Gunnison brings a holistic, multi-disciplinary approach to solving its customers’ biggest problems yielding long term collaborative partnerships with our clients averaging 10 or more years. Our areas of expertise include:

Big Data Management and Analytics Cybersecurity

Agile Development / DevSecOps Geospatial Information Systems

Enterprise Mobile Solutions IT Service Management

Quality Assurance & Automated Testing Infrastructure Management

CONTRACT USE

This contract is available for use by all federal government agencies as a source for Information Technology professional services. Executive agencies, other Federal agencies, mixed-ownership Government corporations, and the District of Columbia; government contractors authorized in writing by a Federal agency pursuant to 48 CFR 51.1; and other activities and organizations authorized by statute or regulation to use GSA as a source of supply may use this contract. Additionally, contractors are encouraged to accept orders received from activities within the Executive Branch of the Federal Government.

CONTRACT SCOPE

The contractor shall provide all resources including personnel, management, supplies, services, materials, equipment, facilities and transportation necessary to provide a wide range of professional services as specified in each task order.

Services specified in a task order may be performed at the contractor’s facilities or the ordering agencies’ facilities. The government will determine the contractor’s compensation by any of several different methods (to be specified at the task order level) e.g., a firm-fixed price for services with or without incentives, labor hours or time-and-material.

mailto:sfarooq@gunnisonconsulting.com

GS-35F-0161Y Page 4

SPECIAL ITEM NUMBER (SIN) DESCRIPTIONS

The Special Item Numbers (SINs) available under this contract provide services across the full life cycle of a project. When task orders are placed, they must identify the SIN or SINs under which the task is being executed.

Gunnison Consulting Group has been awarded a contract by GSA to provide services under the following SINs:

54151HACS Highly Adaptive Cybersecurity Services (HACS) 54151HEAL Health Information Technology Services 54151S Information Technology Professional Services OLM Order-Level Materials (OLM)

Please refer to GSA eLibrary (www.gsaelibrary.gsa.gov) for detailed SIN descriptions.

http://www.gsaelibrary.gsa.gov/

GS-35F-0161Y Page 5

INSTRUCTIONS FOR PLACING ORDERS FOR SERVICES BASED ON

GSA SCHEDULE HOURLY RATES

GSA provides a streamlined, efficient process for ordering the services you need. GSA has already determined that Gunnison Consulting Group, Inc. meets the technical requirements and that our prices offered are fair and reasonable. Agencies may use written orders; facsimile orders, credit card orders, blanket purchase agreement orders or individual purchase orders under this contract.

If it is determined that your agency needs an outside source to provide IT Professional services, follow these simple steps:

Orders under the Micro-Purchase Threshold

• Select the contractor best suited for your needs and place the order.

Orders in-between the Micro-Purchase Threshold and the Simplified Acquisition Threshold

• Prepare a SOW or Performance Work Statement (PWS) in accordance with FAR 8.405-2(b).

• Prepare and send the RFQ (including SOW and evaluation criteria) to at least three GSA Schedule contractors.

• Evaluate, then make a "Best Value" determination.

Note: The ordering activity should request GSA Schedule contractors to submit firm-fixed prices to perform the services identified in the SOW.

Orders over the Simplified Acquisition Threshold

• Prepare the RFQ (including the SOW and evaluation criteria) and post on eBuy to afford all Schedule contractors the opportunity to respond, or provide the RFQ to as many Schedule contractors as practicable, consistent with market research, to reasonably ensure that quotes are received from at least three contractors.

• Seek price reductions.

• Evaluate all responses and place the order, or establish the BPA with the GSA Schedule contractor that represents the best value (refer to FAR 8.405-2(d)).

Note: The ordering activity should request GSA Schedule contractors to submit firm-fixed prices to perform the services identified in the SOW.

Developing a Statement of Work (SOW)

In the SOW, include the following information:

• Work to be performed,

• Location of work,

• Period of performance;

• Deliverable schedule, and

• Special standards and any special requirements, where applicable.

Preparing a Request for Quote (RFQ)

• Include the SOW and evaluation criteria;

• Request fixed price, ceiling price, or, if not possible, labor hour or time and materials order;

• If preferred, request a performance plan from contractors and information on past experience; and include information on the basis for selection.

• May be posted on GSA’s electronic RFQ system, e-Buy

For more information related to ordering services, go to http://www.gsa.gov/schedules-ordering and see guidelines in the Multiple Award Schedule (MAS) Desk Reference Guide.

http://www.gsa.gov/schedules-ordering

GS-35F-0161Y Page 6

BLANKET PURCHASE AGREEMENT

Ordering activities may establish BPAs under any schedule contract to fill repetitive needs for supplies or services.

BPAs may be established with one or more schedule contractors. The number of BPAs to be established is within the discretion of the ordering activity establishing the BPAs and should be based on a strategy that is expected to maximize the effectiveness of the BPA(s). In determining how many BPAs to establish, consider:

• The scope and complexity of the requirement(s);

• The need to periodically compare multiple technical approaches or prices;

• The administrative costs of BPAs; and

• The technical qualifications of the schedule contractor(s).

Establishment of a single BPA, or multiple BPAs, shall be made using the same procedures outlined in 8.405-1 or 8.405-2. BPAs shall address the frequency of ordering, invoicing, discounts, requirements (e.g. estimated quantities, work to be performed), delivery locations, and time.

When establishing multiple BPAs, the ordering activity shall specify the procedures for placing orders under the BPAs.

Establishment of a multi-agency BPA against a Federal Supply Schedule contract is permitted if the multi-agency BPA identifies the participating agencies and their estimated requirements at the time the BPA is established.

Ordering from BPAs:

Single BPA. If the ordering activity establishes one BPA, authorized users may place the order directly under the established BPA when the need for the supply or service arises.

Multiple BPAs. If the ordering activity establishes multiple BPAs, before placing an order exceeding the micro-purchase threshold, the ordering activity shall:

• Forward the requirement, or statement of work and the evaluation criteria, to an appropriate number of BPA holders, as established in the BPA ordering procedures; and

• Evaluate the responses received, make a best value determination (see 8.404(d)), and place the order with the BPA holder that represents the best value.

BPAs for hourly rate services. If the BPA is for hourly rate services, the ordering activity shall develop a statement of work for requirements covered by the BPA. All orders under the BPA shall specify a price for the performance of the tasks identified in the statement of work.

Duration of BPAs. BPAs generally should not exceed five years in length, but may do so to meet program requirements. Contractors may be awarded BPAs that extend beyond the current term of their GSA Schedule contract, so long as there are option periods in their GSA Schedule contract that, if exercised, will cover the BPA’s period of performance.

Review of BPAs:

The ordering activity that established the BPA shall review it at least once a year to determine whether:

• The schedule contract, upon which the BPA was established, is still in effect;

• The BPA still represents the best value (see 8.404(d)); and

• Estimated quantities/amounts have been exceeded and additional price reductions can be obtained.

The ordering activity shall document the results of its review.

GS-35F-0161Y Page 7

LABOR CATEGORY DESCRIPTIONS

In accordance with its standard commercial practices, Gunnison Consulting Group may utilize the education / experience substitutions identified below when assigning personnel to work on a task order:

Experience Substitutions Methodology:

Associates Degree + two (2) years additional related IT Professional Services experience

Substitutes for a Bachelor’s Degree

Bachelor’s Degree + two (2) years additional related IT Professional Services experience

Substitutes for a Master’s Degree

Master’s Degree + three (3) years additional related IT Professional Services experience

Substitutes for a Ph.D.

Bachelor’s Degree + five (5) years additional related IT Professional Services experience

Education Substitutions Methodology:

• A Ph.D. may be substituted for three (3) years of required experience for positions requiring a Master’s Degree or five (5) years with positions requiring a Bachelor’s Degree.

• A Master’s Degree may be substituted for two (2) years of required experience with positions requiring a Bachelor’s Degree.

• A Bachelor’s Degree may be substituted for four (4) years of experience

• Specialized IT certifications may be substituted for two (2) years of experience

54151HACS Labor Categories

Computer Security Specialist I Minimum General Experience: 3 years of experience

Functional Responsibility:

Supports cybersecurity systems and software development teams by providing security-focused documentation and process testing under project management direction. May assist in security reporting and compliance activities.

Minimum Education: Bachelor’s degree

Cyber Advisory Expert Minimum General Experience: 7 years of experience

Functional Responsibility:

The Cyber Advisory Expert provides tactical consulting and support expertise in technical, management, and programmatic topics to advance or support the understanding, development, or implementation of technical strategies, management strategies, or policies.

Minimum Education: Master’s degree

Cyber Advisory Expert - Principal Minimum General Experience: 12 years of experience

Functional Responsibility:

The Principal Cyber Advisory Expert provides strategy consulting and support expertise in technical, management, and programmatic topics to advance or support the understanding, development, or implementation of technical strategies, management strategies, or policies.

Minimum Education: Master’s degree

GS-35F-0161Y Page 8

Cyber Advisory Expert - Senior Minimum General Experience: 9 years of experience

Functional Responsibility:

The Senior Cyber Advisory Expert provides strategy or tactical consulting and support expertise in technical, management, and programmatic topics to advance or support the understanding, development, or implementation of technical strategies, management strategies, or policies.

Minimum Education: Master’s degree

Cyber Analyst III Minimum General Experience: 10 years of experience

Functional Responsibility:

Conducts cybersecurity research and implements secure software development practices, ensuring compliance with federal security frameworks and risk mitigation strategies.

Minimum Education: Bachelor’s degree

Cyber Analytics Specialist SME Minimum General Experience: 10 years of experience

Functional Responsibility:

Develops and implements strategic cybersecurity analytics frameworks, assisting in security risk assessments, vulnerability detection, and compliance reporting.

Minimum Education: Bachelor’s degree

Cyber Configuration Manager II Minimum General Experience: 3 years of experience

Functional Responsibility:

Manages cybersecurity configuration control processes, ensuring compliance with security standards for software, networks, and IT environments.

Minimum Education: Bachelor’s degree

Cyber Program Manager SME Minimum General Experience: 10 years of experience

Functional Responsibility:

Oversees cybersecurity programs, ensuring security measures align with compliance mandates and best practices. Leads risk mitigation and governance strategies.

Minimum Education: Master’s degree

Cyber Project Administrator I Minimum General Experience: 0 years of experience

Functional Responsibility:

Assists in cybersecurity project administration, ensuring adherence to security standards, personnel security requirements, and reporting compliance.

Minimum Education: Bachelor’s degree

Cyber Project Analyst III Minimum General Experience: 3 years of experience

Functional Responsibility:

Manages cybersecurity-related project documentation, monitoring compliance metrics, and security-focused risk management reporting.

Minimum Education: Bachelor’s degree

GS-35F-0161Y Page 9

Cyber Project Control Analyst I Minimum General Experience: 1 year of experience

Functional Responsibility:

The Cyber Project Control Analyst I assists the program and project management team in the coordination of project schedules, plans and deliverables.

Minimum Education: High School’s degree

Cyber Project Director SME Minimum General Experience: 18 years of experience

Functional Responsibility:

Leads cybersecurity programs, managing enterprise security initiatives, risk management, compliance enforcement, and secure IT project execution.

Minimum Education: Bachelor’s degree

Cyber Project Manager I Minimum General Experience: 3 years of experience

Functional Responsibility:

Directs cybersecurity project operations, overseeing security policy adherence, compliance, and implementation of risk mitigation plans.

Minimum Education: Bachelor’s degree

Cyber Project Manager II Minimum General Experience: 5 years of experience

Functional Responsibility:

Manages cybersecurity-focused projects, ensuring secure IT implementations and compliance with cybersecurity regulations.

Minimum Education: Bachelor’s degree

Cyber Project Manager III Minimum General Experience: 10 years of experience

Functional Responsibility:

Oversees large-scale cybersecurity initiatives, ensuring compliance with NIST, FISMA, and other federal security standards.

Minimum Education: Bachelor’s degree

Cyber Project Manager SME Minimum General Experience: 15 years of experience

Functional Responsibility:

Oversees cybersecurity programs, ensuring security measures align with compliance mandates and best practices. Leads risk mitigation and governance strategies.

Minimum Education: Bachelor’s degree

Cyber Quality Assurance Specialist II

Minimum General Experience: 2 years of experience

Functional Responsibility:

Supports cybersecurity quality assurance efforts, performing vulnerability testing, compliance validation, and security control assessments.

GS-35F-0161Y Page 10

Cyber Quality Assurance Specialist

IV

Minimum General Experience: 7 years of experience

Functional Responsibility:

Leads cybersecurity quality assurance activities, defining security testing approaches, process improvements, and compliance validation.

Minimum Education: Bachelor’s degree

Cyber Subject Matter Expert - Principal Minimum General Experience: 15 years of experience

Functional Responsibility:

Principal SME provides cybersecurity leadership in threat intelligence, risk assessment, and security policy development. Advises organizations on advanced security solutions.

Minimum Education: Bachelor’s degree

Cyber Subject Matter Expert I Minimum General Experience: 3 years of experience

Functional Responsibility:

Cyber SME I performs primarily in a lead role utilizing knowhow, expertise and experience in a technical field to assist in evaluating technologies and applying solutions to customer requirements.

Minimum Education: Bachelor’s degree

Cyber Subject Matter Expert II Minimum General Experience: 10 years of experience

Functional Responsibility:

Implements cybersecurity policies, analyzes threats, and ensures compliance with security frameworks.

Minimum Education: Bachelor’s degree

Cyber Technical Lead I Minimum General Experience: 2 years of experience

Functional Responsibility:

Leads cybersecurity teams in secure system development, risk management, and implementation of security best practices.

Minimum Education: Bachelor’s degree

Cyber Technical Lead III Minimum General Experience: 10 years of experience

Functional Responsibility:

Oversees cybersecurity architecture, manages risk assessments, and ensures compliance with federal security standards.

Minimum Education: Bachelor’s degree

Cyber Technical Writer/Editor - Journeyman Minimum General Experience: 0 years of experience

Functional Responsibility:

Develops security documentation, compliance reports, and cybersecurity training materials.

GS-35F-0161Y Page 11

Cyber Technical Writer/Editor III

Functional Responsibility:

Develops cybersecurity documentation, security compliance reports, and vulnerability mitigation guidelines. Ensures adherence to security regulations and standards.

Minimum Education: Bachelor’s degree

Cybersecurity Expert Advisor SME Minimum General Experience: 20 years of experience

Functional Responsibility:

Provides strategic guidance on enterprise cybersecurity frameworks, risk management, and security best practices.

Minimum Education: Bachelor’s degree

Cybersecurity Specialist - Journeyman Minimum General Experience: 0 years of experience

Functional Responsibility:

Implements cybersecurity risk management frameworks, supports security automation, and ensures compliance with security policies.

Minimum Education: Bachelor’s degree

Cybersecurity Specialist I Minimum General Experience: 2 years of experience

Functional Responsibility:

The Cybersecurity Specialist I is a security expert responsible for reviewing or defining the security plans and posture of an organization. Ensure the organization’s networks and systems are secure. May act in consulting capacity to stakeholders.

Minimum Education: Bachelor’s degree

Cybersecurity Specialist II Minimum General Experience: 3 years of experience

Functional Responsibility:

The Cybersecurity Specialist II is a security expert responsible for reviewing or defining the security plans and posture of an organization. Ensure the organization’s networks and systems are secure. Acts in consulting capacity to stakeholders.

Minimum Education: Bachelor’s degree

Cybersecurity Specialist III Minimum General Experience: 5 years of experience

Functional Responsibility:

The Cybersecurity Specialist III is a lead security expert responsible for reviewing or defining the security plans and posture of an organization.

Ensure the organization’s networks and systems are secure. May act in consulting capacity to stakeholders.

Minimum Education: Bachelor’s degree

Enterprise Application Security SME Minimum General Experience: 15 years of experience

Functional Responsibility:

Designs and implements enterprise security architectures, ensuring compliance with security standards such as NIST, FISMA, and Zero Trust.

GS-35F-0161Y Page 12

Information Assurance Advisor II Minimum General Experience: 2 years of experience

Functional Responsibility:

The Information Assurance Advisor II develops security strategies, architectures, and engineering specifications. Conducts strategic planning and recommend implementation strategies. Advise and assist clients on enterprise security and privacy policy.

Minimum Education: Bachelor’s degree

Information Assurance Advisor III Minimum General Experience: 3 years of experience

Functional Responsibility:

The Information Assurance Advisor III develops security strategies, architectures, and engineering specifications. Conducts strategic planning and recommend implementation strategies. Advise and assist clients on enterprise security and privacy policy.

Minimum Education: Bachelor’s degree

Information Assurance Analyst - Journeyman Minimum General Experience: 2 years of experience

Functional Responsibility:

The Information Assurance Analyst - Journeyman analyzes proposed system design(s), and system security documentation for adherence to security practices in accordance with client directives.

Minimum Education: Bachelor’s degree

Information Assurance Analyst I Minimum General Experience: 3 years of experience

Functional Responsibility:

The Information Assurance Analyst I analyzes proposed system design(s), and system security documentation for adherence to security practices in accordance with client directives.

Minimum Education: Bachelor’s degree

Information Assurance Analyst II Minimum General Experience: 4 years of experience

Functional Responsibility:

The Information Assurance Analyst II analyzes proposed system design(s), and system security documentation for adherence to security practices in accordance with client directives.

GS-35F-0161Y Page 13

Information Security Business Process Consultant III Minimum General Experience: 8 years of experience

Functional Responsibility:

Focused on enhanbcing the security posture of an organization with responsibility for defining and developing business processes, policies, roles and responsibilities, and performance metrics. Conducts analysis of business processes: current state analysis, gap analysis, benchmarking, best practices identification, organizational assessment, and other related tasks. Takes project from original concept through final implementation. May coordinate with business and technology teams, ascertaining system requirements, such as program functions, output requirements, input data acquisition, and system techniques and controls. Conduct client interviews. May deliver presentations and training courses including measurement, analysis, improvement, and control. Interfaces with all areas of project including customer, computer services, and client services.

Minimum Education: Bachelor’s degree

Information Security Program Advisor II Minimum General Experience: 3 years of experience

Functional Responsibility:

The Information Security Program Advisor II acts as senior advisor in applying knowledge to research and evaluate outcomes involving specialized and technical areas impacting recommendations and development of new policies, procedures and services.

Minimum Education: Bachelor’s degree

Information Security Program Facilitator SME Minimum General Experience: 15 years of experience

Functional Responsibility:

Specific experience leading cross-functional teams with a goal of producing security solutions and requirements and/or specifications. Leads solutioning sessions, systems requirements sessions, planning sessions, risk management efforts, and evaluations or recommendations of security focused technology and methodology. Contributes to or leads development of team results/products.

Minimum Education: Bachelor’s degree

Information Systems Security Officer I

Minimum General Experience: 1 year of experience

Functional Responsibility:

The Information Systems Security Officer I defines information security policies, plans, and standards for various organizations. Supports security teams in implementing the information security controls, detecting intrusions, conducting vulnerability assessments and finding solutions to fix potential weak spots for breaches.

GS-35F-0161Y Page 14

Information Systems Security Officer II

Functional Responsibility:

The Information Systems Security Officer II defines information security policies, plans, and standards for various organizations. Supports security teams in implementing the information security controls, detecting intrusions, conducting vulnerability assessments and finding solutions to fix potential weak spots for breaches.

Minimum Education: Bachelor’s degree

Information Systems Security Officer III

Minimum General Experience: 5 years of experience

Functional Responsibility:

The Information Systems Security Officer III defines information security policies, plans, and standards for various organizations. Supports security teams in implementing the information security controls, detecting intrusions, conducting vulnerability assessments and finding solutions to fix potential weak spots for breaches.

Minimum Education: Bachelor’s degree

Information Technology Operations and Systems Security Officers SME Minimum General Experience: 10 years of experience

Functional Responsibility:

Oversees the efforts of security staff to design, develop, engineer and implement solutions to security requirements. Responsible for the implementation and development of IT security. Manages the 24X7X365 Security Operations Center (SOC) Gathers and organizes technical information about an organization's mission goals and needs, existing security products, and ongoing programs in the MLS arena. Performs risk analyses which also includes risk assessment. Provide support to plan, coordinate, and implement the organization’s information security. Provide support for facilitating and helping agencies identify their current security infrastructure and define future programs, design and implementation of security related to IT systems. A working knowledge of several of the following areas is required:

understanding of business security practices and procedures; knowledge of current security tools available; hardware/software security implementation;

different communication protocols; encryption techniques/tools; familiarity with commercial products, and current Internet/EC technology. Provides daily supervision and direction to staff.

Minimum Education: Master’s degree

Lead Cybersecurity Analyst III Minimum General Experience: 7 years of experience

Functional Responsibility:

Support the development and implementation of security work plans to fulfill client requirements. Oversee a task or work order, including methodology, communications, risk management, and budget management. Support formulation of milestone schedules or other documented plans. Analyze new and project-related issues or risks and suggest solutions that normally involve the schedule, technology, methodology, tools, solution components, and financial management of the project.

GS-35F-0161Y Page 15

Mobile Security Specialist - Journeyman Minimum General Experience: 1 year of experience

Functional Responsibility:

Supports the development of security solutions in mobile security. Suports security implementation and performs/supports testing of mobile devices.

Minimum Education: Bachelor’s degree

Mobile Security Specialist I Minimum General Experience: 2 years of experience

Functional Responsibility:

Develop security solutions or implement other emerging technologies. Apply proficiency in mobile security. Implement approved requirements via security implementation, and perform or support testing activities, as assigned by the project lead. May lead development of specific modules and portions of team CM and QA processes as directed. Ensure version control of all security software.

Minimum Education: Bachelor’s degree

Mobile Security Specialist III Minimum General Experience: 4 years of experience

Functional Responsibility:

Develop security solutions or implement other emerging technologies, leading specific modules and assignments. Apply high level of proficiency in mobile security. Lead day-to-day support activities. Ensure effective and efficient implementation of requirements; define coding standards; direct releases, to include content and verification of release readiness. Support customers by investigating issues and providing feedback on change requests.

Minimum Education: Bachelor’s degree

Penetration Test Engineer - Journeyman Minimum General Experience: 1 year of experience

Functional Responsibility:

Must have moderate proficiency in specified security testing or applicable field. Performs testing activities under the direction of project leads, either automated or manual to indentify vulnerabilities and may provide mitigation recommendations.

Minimum Education: Bachelor’s degree

Penetration Test Engineer II Minimum General Experience: 2 years of experience

Functional Responsibility:

Leads security testing projects and teams, while also performing testing activities. Develops and briefs security findings reports and remediation strategies to stakeholders.

Minimum Education: Bachelor’s degree

Penetration Test Engineer IV Minimum General Experience: 7 years of experience

Functional Responsibility:

Develops security testing strategies for enterprise projects. Performs high level and complex testing activities. Develops and briefs security findings reports and remediation strategies to stakeholders.

GS-35F-0161Y Page 16

Penetration Test Engineer SME Minimum General Experience: 15 years of experience

Functional Responsibility:

Leads teams of security experts and develops security strategies for testing enterprise projects. Performs high level and complex testing activities.

Develops and briefs security findings reports and remediation strategies to stakeholders.

Minimum Education: Bachelor’s degree

Security Administrator - Journeyman

Minimum General Experience: 1 years of experience

Functional Responsibility:

Supports the administration of security tools, projects and iniatives under the direction of the team lead.

Minimum Education: Bachelor’s degree

Security Administrator I Minimum General Experience: 3 years of experience

Functional Responsibility:

Administers security tools, projects and iniatives in support of organizational security programs.

Minimum Education: Bachelor’s degree

Security Analyst - Journeyman Minimum General Experience: 1 year of experience

Functional Responsibility:

Supports the analysis of proposed system design(s), and system security documentation for adherence to security practices in accordance with client directives. Makes detailed observations, conducts interviews, performs research, analyzes information, and interprets results. Compiles results and provides reports and presentations on results and recommendations.

Minimum Education: Bachelor’s degree

Security Analyst II Minimum General Experience: 4 years of experience

Functional Responsibility:

Independantly performs the analysis of proposed system design(s), and system security documentation for adherence to security practices in accordance with client directives. Makes detailed observations, conducts interviews, performs research, analyzes information, and interprets results.

Compiles results and provides reports and presentations on results and recommendations.

Minimum Education: Bachelor’s degree

Security Analyst I Minimum General Experience: 3 years of experience

Functional Responsibility:

Supports and is able to carry out the analysis of proposed system design(s), and system security documentation for adherence to security practices in accordance with client directives. Makes detailed observations, conducts interviews, performs research, analyzes information, and interprets results.

Compiles results and provides reports and presentations on results and recommendations.

GS-35F-0161Y Page 17

Security Analyst III Minimum General Experience: 7 years of experience

Functional Responsibility:

Leads the analysis of proposed system design(s), and system security documentation for adherence to security practices in accordance with client directives. Makes detailed observations, conducts interviews, performs research, analyzes information, and interprets results. Compiles results and provides reports and presentations on results and recommendations.

Minimum Education: Bachelor’s degree

Security Architect - Journeyman Minimum General Experience: 1 year of experience

Functional Responsibility:

Support the designs of secure systems, enforces security policies, and ensures compliance with security frameworks.

Minimum Education: Bachelor’s degree

Security Architect I Minimum General Experience: 3 years of experience

Functional Responsibility:

Designs secure systems, enforces security policies, and ensures compliance with security frameworks.

Minimum Education: Bachelor’s degree

Security Architect II Minimum General Experience: 5 years of experience

Functional Responsibility:

Develops cybersecurity strategies, implements security controls, and mitigates security risks.

Minimum Education: Bachelor’s degree

Security Architect III Minimum General Experience: 7 years of experience

Functional Responsibility:

Oversees enterprise security architecture, ensures compliance, and enhances security posture.

Minimum Education: Bachelor’s degree

Security Architect IV Minimum General Experience: 15 years of experience

Functional Responsibility:

Designs and implements enterprise security architectures, ensuring compliance with cybersecurity policies and risk management frameworks.

Minimum Education: Bachelor’s degree

Security Engineer - Journeyman Minimum General Experience: 1 year of experience

Functional Responsibility:

The Security Engineer - Journeyman participates in the development of advanced methods, theories and research techniques in the solution of security environment requirements and problems. May plan, conduct, and direct technical teams or projects.

GS-35F-0161Y Page 18

54151HEAL Labor Categories

Chief Information Security Officer Minimum General Experience: Six (6) years of experience Functional Responsibility: Responsible for establishing and maintaining Health IT enterprise information security standards. Tasked with the development, implementation, and enforcement of these standards and procedures. Responsible for safeguarding Health IT information systems’ sensitive data assets, including conducting regular audits, staying up to date with emerging threats, and implementing advanced security measures.

Health IT Application Engineer I Minimum General Experience: One (1) year of experience Functional Responsibility: Assists in analyzing functional Health IT business applications and design specifications for functional activities. Assist in the preparation of required documentation, including both user and program documentation. Enhance Health IT applications to improve performance and add functionality.

Health IT Application Engineer II Minimum General Experience: Three (3) years of experience Functional Responsibility: Analyze and study complex Health IT system requirements. Design software tools and subsystems to support software reuse and manages the implementation. Estimate software development costs and schedule. Review existing programs and assist in making refinements, reducing operating time, and improving current techniques. Supervise software configuration management.

Health IT Applications Programmer III Minimum General Experience: Six (6) years of experience Functional Responsibility: Analyze Health IT functional business applications and design specifications.

Translate detailed design into computer software. Test, debug, and refine the computer software to produce the required product. Prepare required documentation, including both program-level and user-level documentation.

Enhance software to reduce operating time or improve efficiency. Provide technical direction to programmers to ensure program deadlines are met. Experience in Health IT information system design, including application programming.

Security Engineer I Minimum General Experience: 3 years of experience

Functional Responsibility:

Implements security solutions, mitigates cyber threats, and ensures secure system configurations.

Minimum Education: Bachelor’s degree

Security Engineer II Minimum General Experience: 5 years of experience

Functional Responsibility:

Develops security policies, manages network security, and mitigates vulnerabilities.

Minimum Education: Bachelor’s degree

Security Engineer III Minimum General Experience: 7 years of experience

Functional Responsibility:

Conducts advanced security research, develops secure software solutions, and mitigates security risks in IT environments.

GS-35F-0161Y Page 19

Health IT Bioinformatician

Functional Responsibility: Provides high level expertise in the application of technology to areas of interest to government health organizations including Medical or Public Health Informatics. Provides expertise across a wide variety of IT areas as applied to public health, including information retrieval technology, decision science, web technology, data mining, expert systems, networking, public health science, and education.

Health IT Business Analyst I

Functional Responsibility: Assists with the implementation of best practices in the healthcare sector. Provides expertise in the business process and the development of business models, system analysis, design, and improvement. Evaluates healthcare organizations, helps define engagement strategies, and identifies IT inadequacies.

Health IT Business Analyst II

Functional Responsibility: Assists with the implementation of best practices in the healthcare sector. Provides senior-level expertise in the business process and the development of business models, system analysis, design, and improvement. Evaluates healthcare organizations, helps define engagement strategies, and identifies IT inadequacies.

Health IT Business Analyst III

Functional Responsibility: Leads the implementation of best practices in the healthcare sector. Leads the business process and development of business models, system analysis, design, and improvement. Evaluates healthcare organizations, defines engagement strategies, and identifies IT inadequacies.

Health IT Computer Security System Specialist I

Functional Responsibility: Assist in defining security requirements for Multilevel Security (MLS) issues.

Design, develop, engineer, and implement solutions to MLS requirements on Health IT program. Gather and organize technical information about an Health IT focused organization's mission goals and needs, existing security products, and ongoing programs in the MLS arena. Perform risk analyses which also includes risk assessment.

Health IT Computer Security System Specialist II

Functional Responsibility: Analyze and defines security requirements for MLS issues. Design, develop, engineer, and implement solutions to MLS requirements. Guide effort to gather and organize technical information about an organization's mission goals and needs, existing security products, and ongoing programs in the MLS arena. Develop security standards.

Health IT Computer Security System Specialist III

GS-35F-0161Y Page 20

Functional Responsibility: Perform complex risk analyses and assessment on Health IT programs. Establish and satisfy information assurance and security requirements based upon the analysis of user, policy, regulatory, and resource demands. Support Health IT programs at the highest levels in the development and implementation of doctrine and policies. Perform analysis, design, and development of security features for Health IT system architectures.

Health IT Configuration Management Specialist

Functional Responsibility: Expert guidance in configuration management planning for Health IT programs.

Responsible for outlining provisions for key aspects such as configuration identification, change control, configuration status accounting, and conducting configuration audits. Ensures robust, secure, and efficient systems that support the delivery of optimal administrative efficiency.

Health IT Database Administrator

Functional Responsibility: Analyze database requirements of Health IT programs. Analyze and determine information needs and elements, database relationships and attributes, proposed manipulation, data flow and storage requirements, and data output and reporting capabilities. Apply knowledge of database management systems to coordinate maintenance and changes to databases. Test and implement changes or new database designs. Knowledge of and ability to monitor databases and to analyze and organize data and apply new technology designs and programs.

Health IT Database Management Specialist I

Functional Responsibility: Provides administrative support to Health IT program requirements. Assists in maintaining the integrity and performance of company databases, ensuring all data remains consistent and clearly defined across databases, and easily accessible by users. Performs regular data entry, conducts complex data queries, and generates detailed reports for various healthcare departmental needs.

Health IT Database Management Specialist II

Functional Responsibility: Provides highly technical expertise in the application of Database Management Systems (DBMS) within the Health IT environment. Evaluates available DBMS products and makes professional recommendations that align with validated user requirements. Contributes to the testing process and assists in the implementations of modifications or new Health IT database designs. Actively monitoring database utilization and statistics, enabling proactive measures and adjustments to ensure optimal performance and efficiency.

Health IT Database Management Specialist III

Functional Responsibility: Manage the development of data base projects. Plan and budget staff and data base resources. When necessary, reallocate resources to maximize benefits. Prepare and deliver presentations on DBMS concepts. Provide daily supervision and direction to support staff. Extensive knowledge of relational database environment.

Health IT Database Specialist I

GS-35F-0161Y Page 21

Functional Responsibility: Assists in evaluating suitable DBMS products that align with user requirements.

Understanding user needs, researching various DBMS products, and making recommendations. Determines the ideal file organization and indexing methods for specific user applications, optimizing data retrieval and storage efficiency.

Health IT Database Specialist II

Functional Responsibility: Evaluates suitable DBMS products that align with user requirements. Understanding user needs, researching various DBMS products, and making recommendations. Determines the ideal file organization and indexing methods for specific user applications, optimizing data retrieval and storage

Health IT Database Specialist III

Functional Responsibility: Manages the suitable DBMS products that align with user requirements.

Understanding user needs, researching various DBMS products, and making recommendations. Determines the ideal file organization and indexing methods for specific user applications, optimizing data retrieval and storage

Health IT Data Security Specialist

Functional Responsibility: Provides support to plan, coordinate, and implement the organization’s information security. Understands business security practices and procedures; knowledge of current security tools available; hardware/software firewalls and their implementation; different communication protocols; encryption techniques/tools; familiarity with commercial products.

Health IT Functional Analyst I

Functional Responsibility: Support definition of Health IT financial business practices and incorporate processes into an automated solution. Assist in applying sound accounting and data processing principles.

Integrate government financial business practices. Identify potential problems and solutions through analysis and recommends solutions. Work with functional specialists, vendors, and customers to effectively automate requirements.

Health IT Functional Analyst II

Functional Responsibility: Analyzes user needs to determine functional and cross-functional Health IT requirements. Performs functional allocations to identify required tasks and their interrelationships. Identifies resources required for each task. Provides daily supervision and direction to support staff.

Health IT Information Engineer I

Functional Responsibility: Apply Health IT business process improvement practices to assist in re-engineering methodologies/principles and business process modernization projects. Assist in establishing standards for information systems procedures.