IT-70 - Fulcrum It Services, LLC - GS35F0480W

Fulcrum IT Services, LLC GS-35F-0480W Page 1 of 108

GENERAL SERVICES ADMINISTRATION

AUTHORIZED SCHEDULE CATALOG/PRICE LIST

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order is available through GSA Advantage!, a menu-driven database system. The INTERNET address for GSA Advantage! is http://www.gsaadvantage.gov

FEDERAL SUPPLY SCHEDULE 70

GENERAL PURPOSE COMMERCIAL INFORMATION TECHNOLOGY

EQUIPMENT, SOFTWARE and SERVICES

CONTRACT NUMBER: GS-35F-0480W

CONTRACT PERIOD: June 14, 2010 through June 13, 2020

PRICELIST CURRENT THROUGH: Modification 19 dated December 22, 2016

For more information on ordering, visit www.gsa.gov/schedules

CONTRACTOR: Fulcrum IT Services, LLC 5870 Trinity Parkway Suite 400 Centreville, VA 20120-1974

703-543-2900 (phone) 703-543-2914 (facsimile) www.FulcrumCo.com

CONTRACTOR’S POINT OF CONTACT FOR CONTRACT ADMINISTRATION:

Kelly Bower Fulcrum IT Services, LLC

5870 Trinity Parkway Suite 400 Centreville, VA 20120-1974 703-543-2979 (phone) 703-543-2914 (facsimile)

KBower@FulcrumIT.com

BUSINESS SIZE: Large http://www.gsaadvantage.gov/ http://www.gsa.gov/schedules http://www.fulcrumco.com/ mailto:KBower@FulcrumIT.com

Fulcrum IT Services, LLC GS-35F-0480W Page 2 of 108

CONTRACTOR INFORMATION

Fulcrum has been providing services to the federal government for over 20 years, focusing on six core competencies: Technology, Cyber Security, Intelligence Analysis & Ops, Mission Systems, Human Capital, and Healthcare Services. Fulcrum’s leadership in the world of IT professional services is grounded and provides Pivotal Performance in a very basic but steadfast commitment to customer satisfaction. It is a philosophy that permeates our corporate culture and provides the backbone for our business processes

1a. TABLE OF AWARDED SPECIAL ITEM NUMBERS (SINs):

SIN 132-45D Risk and Vulnerability Assessment

SIN 132-51 Information Technology Professional Services

SIN 132-56 Health IT

1b. LOWEST PRICED MODEL NUMBER AND PRICE FOR EACH SIN:

Not Applicable

1c. HOURLY RATES: See Pricelist in Section 28.

2. MAXIMUM ORDER: See NOTE TO ORDERING ACTIVITIES (below)

SIN 132-45D $500,000

SIN 132-51 $500,000

SIN 132-56 $500,000

NOTE TO ORDERING ACTIVITIES: *If the best value selection places your order over the Maximum Order identified in this catalog/pricelist, you have an opportunity to obtain a better schedule contract price. Before placing your order, contact the aforementioned Contactor for a better price. The Contractor may (1) offer a new price for this requirement, (2) offer the lowest price available under this contract or (3) decline the order. A delivery order that exceeds the maximum order may be placed under the schedule contract in accordance with FAR 8.404.

3. MINIMUM ORDER: $100

4. GEOGRAPHIC COVERAGE: Domestic

5. POINT(S) OF PRODUCTION: Centreville, Virginia, USA

6. DISCOUNT FROM INTERNAL RATE:

http://fulcrumit-design.idevdesign.net/services-and-solutions/technology/ http://fulcrumit-design.idevdesign.net/services-and-solutions/cyber-security/ http://fulcrumit-design.idevdesign.net/services-and-solutions/intelligence-analysis-and-ops/ http://fulcrumit-design.idevdesign.net/services-and-solutions/mission-systems/ http://fulcrumit-design.idevdesign.net/services-and-solutions/human-capital/ http://fulcrumit-design.idevdesign.net/services-and-solutions/human-capital/ http://fulcrumit-design.idevdesign.net/services-and-solutions/healthcare-services/

Fulcrum IT Services, LLC GS-35F-0480W Page 3 of 108

The GSA Net Prices published on the GSA Advantage website reflect the fully burdened price. The negotiated discount has been applied and the Industrial Funding Fee has been added.

7. QUANTITY or VOLUME DISCOUNT: None

8. PROMPT PAYMENT TERMS: Net 30 Days

9a. GOVERNMENT PURCHASE CARD:

Accepted for sales at or below the micro-purchase threshold.

9b. GOVERNMENT PURCHASE CARD:

Please contact the Contractor for terms and conditions applicable to use of the

Government Purchase Card for purchases above the micro-purchase threshold.

10. FOREIGN ITEMS: None

11a. TIME OF DELIVERY:

Negotiated at the Task Order Level with the Ordering Activity.

11b. EXPEDITED DELIVERY:

Please contact the Contractor for availability and rates.

11c. OVERNIGHT AND 2-DAY DELIVERY:

Please contact the Contractor for availability and rates.

11d. URGENT REQUIRMENTS:

Agencies can contact the Contractor’s representative to affect a faster delivery.

Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

12. FOB POINT: Destination

13a. ORDERING ADDRESS:

5870 Trinity Parkway, Suite 400

Fulcrum IT Services, LLC GS-35F-0480W Page 4 of 108

Centreville, VA 20120-1974 703-543-2900 (phone) 703-543-2914 (facsimile) EDI Orders: Please e-mail Contracts@FulcrumCO.com

13b. ORDERING PROCEDURES:

Ordering activities shall use the ordering procedures described in Federal Acquisition Regulation 8.405-3 when placing an order or establishing a BPA for supplies or services. The ordering procedures, information on Blanket Purchase Agreements (BPA’s) and a sample BPA can be found at the GSA/FSS Schedule Homepage (http://gsa.gov/portal/category/100643).

14. PAYMENT ADDRESS:

5870 Trinity Parkway Suite 400 Centreville, VA 20120-1974

15. WARRANTY PROVISION: Delivered, as Negotiated

16. EXPORT PACKING CHARGES: Not Applicable

17. TERMS AND CONDITIONS OF GOVERNMENT PURCHASE CARD

ACCEPTANCE: Please contact the Contractor for terms and conditions for acceptance of the Government Purchase Card.

18. TERMS AND CONDITIONS OF RENTAL, MAINTENANCE, AND REPAIR (IF

APPLICABLE): Not Applicable

19. TERMS AND CONDITIONS OF INSTALLATION: Not Applicable

20. TERMS AND CONDITIONS OF REPAIR PARTS INDICATING DATE OF

PARTS PRICE LISTS AND ANY DISCOUNTS FROM LIST PRICES (IF

AVAILABLE): Not Applicable

20a. TERMS AND CONDITIONS FOR ANY OTHER SERVICES: Not Applicable

21. LIST OF SERVICE AND DISTRIBUTION POINTS: Not Applicable

22. LIST OF PARTICIPATING DEALERS: None http://gsa.gov/portal/category/100643

Fulcrum IT Services, LLC GS-35F-0480W Page 5 of 108

23. PREVENTIVE MAINTENANCE: None

24a. SPECIAL ATTRIBUTES SUCH AS ENVIRONMENTAL ATTRIBUTES (e.g.

recycled content, energy efficiency, and/or reduced pollutants): None

24b. SECTION 508 COMPLIANCE FOR ELECTRONIC and INFORMATION

TECHNOLOGY: Not Applicable

25. DUNS NUMBER: 048382386

26. NOTIFICATION REGARDING REGISTRATION IN SYSTEM FOR AWARD

MANAGEMENT (SAM) DATABASE: Contractor has an Active Registration in the SAM database.

27. TERMS and CONDITIONS / LABOR CATEGORIES DESCRIPTIONS FOR:

SIN 132-45D Risk and Vulnerability Assessment

SIN 132-51 Information Technology Professional Services

SIN 132-56 Health IT

See following pages.

Fulcrum IT Services, LLC GS-35F-0480W Page 6 of 108

TERMS AND CONDITIONS APPLICABLE TO HIGHLY ADAPTIVE

CYBERSECURITY SERVICES (HACS) (SPECIAL ITEM NUMBERS 132-45D)

Vendor suitability for offering services through the Highly Adaptive Cybersecurity

Services (HACS) SINs must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

● Federal Acquisition Regulation (FAR) Part 52.204-21

● OMB Memorandum M-06-19 - Reporting Incidents Involving Personally Identifiable

Information and Incorporating the Cost for Security in Agency Information Technology

Investments

● OMB Memorandum M -07-16 - Safeguarding Against and Responding to the Breach of

Personally Identifiable Information

● OMB Memorandum M-16-03 - Fiscal Year 2015-2016 Guidance on Federal Information

Security and Privacy Management Requirements

● OMB Memorandum M-16-04 – Cybersecurity Implementation Plan (CSIP) for Federal

Civilian Government

● The Cybersecurity National Action Plan (CNAP)

● NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information

Technology Systems

● NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security)

● NIST SP 800-30 - Guide for Conducting Risk Assessments

● NIST SP 800-35 - Guide to Information Technology Security Services

● NIST SP 800-37 - Guide for Applying the Risk Management Framework to Federal

Information Systems: A Security Life Cycle Approach

● NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View

● NIST SP 800-44 - Guidelines on Securing Public Web Servers

● NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

● NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and

Organizations

● NIST SP 800-61 - Computer Security Incident Handling Guide

● NIST SP 800-64 - Security Considerations in the System Development Life Cycle

● NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

● NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

● NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment

● NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information

Systems

Fulcrum IT Services, LLC GS-35F-0480W Page 7 of 108

● NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations

● NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

● NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal

Information Systems and Organizations

****NOTE: All non-professional labor categories must be incidental to, and used solely to support Highly Adaptive Cybersecurity Services, and cannot be purchased separately.

1. SCOPE

a. The labor categories, prices, terms and conditions stated under Special Item Number 132-

45D High Adaptive Cybersecurity Services apply exclusively to High Adaptive Cybersecurity

Services within the scope of this Information Technology Schedule.

b. Services under these SINs are limited to Highly Adaptive Cybersecurity Services only.

Software and hardware products are under different Special Item Numbers on IT Schedule 70

(e.g. 132-32, 132-33, 132-8), and may be quoted along with services to provide a total solution.

c. These SINs provide ordering activities with access to Highly Adaptive Cybersecurity services only.

d. Highly Adaptive Cybersecurity Services provided under these SINs shall comply with all

Cybersecurity certifications and industry standards as applicable pertaining to the type of services as specified by ordering agency.

e. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2. ORDER

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket

Purchase Agreements, individual purchase orders, or task orders for ordering services under this contract. Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

Fulcrum IT Services, LLC GS-35F-0480W Page 8 of 108

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

3. PERFORMANCE OF SERVICES

a. The Contractor shall commence performance of services on the date agreed to by the

Contractor and the ordering activity. All Contracts will be fully funded.

b. The Contractor agrees to render services during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of Highly Adaptive Cybersecurity

Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts. All travel will be agreed upon with the client prior to the Contractor’s travel.

4. INSPECTION OF SERVICES

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND

CONDITIONS – COMMERCIAL ITEMS (MAY 2015) (ALTERNATE II – JUL 2009) (FAR

DEVIATION – JUL 2015) (TAILORED) for Firm-Fixed Price and Time-and-Materials and

Labor-Hour Contracts orders placed under this contract.

5. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then

FAR 52.227-14 (MAY 2014) Rights in Data – General, may apply.

The Contractor shall comply with contract clause (52.204-21) to the Federal Acquisition

Regulation (FAR) for the basic safeguarding of contractor information systems that process, store, or transmit Federal data received by the contract in performance of the contract. This includes contract documents and all information generated in the performance of the contract.

Fulcrum IT Services, LLC GS-35F-0480W Page 9 of 108

6. RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to the ordering activity’s security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Highly Adaptive Cybersecurity Services.

7. INDEPENDENT CONTRACTOR

All Highly Adaptive Cybersecurity Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

8. ORGANIZATIONAL CONFLICTS OF INTEREST

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the

Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the

Contractor or its affiliates or (ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract.

Examples of situations, which may require restrictions, are provided at FAR 9.508.

9. INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for Highly

Adaptive Cybersecurity Services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion

Fulcrum IT Services, LLC GS-35F-0480W Page 10 of 108 of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

10. RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

11. APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity's

Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

12. DESCRIPTION OF HIGHLY ADAPTIVE CYBERSECURITY SERVICES

LABOR CATEGORY DESCRIPTIONS – SIN 132-45D

Cybersecurity Architect

Functional Responsibility:

Develops cybersecurity requirements and architectures by evaluating organization’s mission, business goals and applying applicable NIST SP 800 guidance, federal law, organizational policy and best practices. Plans security policy and systems by evaluating network and security technologies; such as local area networks (LANs), wide area networks (WANs), virtual private networks (VPNs), routers, firewalls, and related security and network devices; designs public key infrastructures (PKIs), including use of certification authorities (CAs) and digital signatures as well as security hardware and software. Implements security systems, specifies intrusion detection methodologies, directs equipment and software installation and calibration, and plans preventive and reactive defensive measures. Plans continuous monitoring, incident response, access control, and compliance standards, policies and procedures. Improves security posture by analyzing security environment, identifying security gaps and evaluation and implementing upgrades. Verifies security by developing testing tools, scenarios, and scripts. Develops cybersecurity reports by collecting, analyzing and summarizing data and trends. Maintains job knowledge by tracking emerging security practices, standards, technology and threats. Improves security team by answering questions and educating junior members.

Minimum/General Experience:

A Cybersecurity Architect must demonstrate at least ten (10) years of experience. Eight (8) years should be specialized experience. The remainder may be any combination of specialized and/or general experience. A history of progression to more complex IT environments and experience is desired.

Fulcrum IT Services, LLC GS-35F-0480W Page 11 of 108

Minimum Education:

Generally requires a Master's degree in Computer Science, Cybersecurity, Information Systems, Engineering, Business, or other related discipline with 8 to 10 years of experience. A Ph.D.

degree with 6 to 8 years. A Bachelor’s degree with over 10 years.

Applicable Training: (If Any)

Certification by an industry recognized cybersecurity authority such as ISC2 or SANS Institute is strongly desired.

Cyber Subject Matter Expert II

Expert consulting in highly specialized, leading edge cyber-related solutions involving information technologies and methodologies. Provides highly technical specialized guidance with regard to automated solutions to complex information processing problems. Often called upon as one of a few nationally recognized specialists with unique knowledge and skills.

Minimum/General Experience:

Twelve years of progressively responsible experience involving information technology and related systems and often unique specialization. Recognized as an industry or specialty expert especially in the use of information processing, telecommunications, or security systems, through exposure such as publications, research, teaching, and speeches.

Advanced degree in specialty area, information technology, computer science, operations research, electrical engineering, or mathematics. Four (4) years of applicable experience may be substituted for a degree.

Cyber Project Manager

Provides cyber-related project management and oversight. Responsible for project performance tracking and reporting, project planning, project schedule management, and project metric analysis including earned value and variance analysis. Responsible for coordinating communication among all project stakeholders. Leverages best practices in the project management discipline including the Project

Management Body of Knowledge (PMBOK).

Five (5) or more years of general IT services experience or subject matter expertise and/or certifications in project management or related disciplines.

Fulcrum IT Services, LLC GS-35F-0480W Page 12 of 108

Bachelor of Science in Computer Science, Information Systems, Computer Engineering or related field or equivalent military or commercial experience.

Cyber Program Manager, Lead

Functional Responsibility: Directs all activities of one or more major cyber-related contracts, programs, projects, technologies, or clients, or directs all activities for a variety of different cyber-related programs/clients which cross over/ involve two or more functional areas. Provides overall leadership for the program and ensures activities are managed in a cost-effective manner within budgetary guidelines. Leadership is consistent with applicable NIST SP 800 guidance, federal law, organizational policy and best practices and supports the success, of the overall organization. Plans, develops and administers policies covering two or more functional areas.

Establishes work policies and practices for business unit being directed. Oversees and approves selection, performance measurement and promotion or termination, or other personnel actions involving staff. Designs and sets measurement standards for the functional area(s) or contract(s).

Minimum/General Experience:

A Lead Cyber Program Manager [Program Director] must demonstrate at least twelve (12) years of experience. Nine (9) years should be specialized experience. The remainder may be any combination of specialized and/or general experience. The Lead Cyber Program Manager

[Program Director] must have been involved in supervision and management of administrative/scientific system software development projects with ten (10) or more people. A minimum of four (4) years of the nine (9) years should include managing large, complex software development projects, including at least thirty (30) employees, in subordinate groups.

Nine (9) years of progressively more difficult software development and ADP experience is desired.

Minimum Education:

Generally requires a Masters degree in Computer Science, Cybersecurity, Information Systems, Engineering, Business, or other related discipline with 9 to 11 years of experience. A Ph.D.

degree with 7 to 9 years. A Bachelor’s degree with 12 to 15 years.

Applicable Training: (If Any)

Certification by an industry recognized cybersecurity authority such as ISC2, SANS Institute, or

Project Management Institute is strongly desired.

Fulcrum IT Services, LLC GS-35F-0480W Page 13 of 108

Cybersecurity Manager

Oversees the implementation and maintenance of cybersecurity-related measures throughout the program, to protect the confidentiality, integrity, and availability of systems and data. Establishes and documents cybersecurity policies in conformance with applicable Federal security laws, regulations, and guidelines, including but not limited to FISMA, FIPS, NIST publications, and

OMB memorandums, as well as policies and guidelines published by [agency we are working for]. Creates and maintains a system security plan and plans for data security (including encryption and treatment of sensitive or personally identifiable information), contingency planning (including backup and recovery), incident response, physical and online access control, vulnerability and penetration testing, anti-malware protection, configuration management, decommissioning of equipment, staff security training, and onboarding and offboarding of staff.

Conducts Certification and Accreditation (C&A) activities and Continuing Security Assessments

(CSAs), and responds to supplemental requests for security-related information from [agency].

Plans, oversees, and tracks remediation for any Plans of Actions and Milestones (POA&Ms) issued by [agency]. Arranges suitable security awareness training and updates for program staff, including any training prescribed by [agency] for contractors. Works with other members of the security team and with project managers to have required security measures implemented at the program level and under each project and confirms their implementation. Plans, conducts, reports on the outcomes of internal audits and interviews to verify that practices implementing required security measures are documented and are being followed. Plans for and tracks remediation of deficiencies discovered during audits and interviews. Reports to program management about the state of the program’s security profile and about concerns and issues as they arise.

Minimum/General Experience:

A Cybersecurity Manager must demonstrate at least seven (7) years of experience. Four (4) years should be specialized experience. The remainder may be any combination of specialized and/or general experience. A history of progression to more complex IT environments and experience is desired.

Minimum Education:

Generally requires a Bachelor’s degree in Computer Science, Cybersecurity, Information

Systems, Engineering, Business, or other related discipline with 7 years of experience. A

Master’s degree with 4 to 6 years. A Ph.D. degree with 2 to 4 years.

Applicable Training: (If Any)

Fulcrum IT Services, LLC GS-35F-0480W Page 14 of 108

Cybersecurity Engineer

Engineers, implements, and monitors security solutions that meet Federal law, NIST guidance, organization policy, and best practices for the protection of information across the IT spectrum.

Identify and define cyber security requirements based on an organization’s mission and business goals. Develops detailed design and implementation documentation. Configures and troubleshoots security tools and technologies within the IT infrastructure. Develops technical solutions and new security measures to mitigate vulnerabilities and automate repeatable tasks.

Prepares assessment and operating procedure documentation and assists with incident response actions. Drafts technical reports on new technologies and assessment findings. Maintains job knowledge by tracking emerging security practices, standards, technology and threats. Improves security team by answering questions and educating junior members.

Minimum/General Experience:

A Cybersecurity Engineer must demonstrate at least eight (8) years of experience. Four (4) years should be specialized experience. The remainder may be any combination of specialized and/or general experience. A history of progression to more complex IT environments and experience is desired.

Minimum Education:

Generally requires a Master’s degree in Computer Science, Cybersecurity, Information Systems, Engineering, Business, or other related discipline with 6 to 8 years of experience. A Ph.D. degree with 4 to 6 years. A Bachelor’s degree with 10 years.

Applicable Training: (If Any)

Cyber Senior Information Assurance Analyst

Reviews security-related documents (e.g., System Architecture; Authentication & Authorization designs, etc.) for cyber-related projects to ensure compliance with federal (e.g., NIST) and organization-specific security guidelines/requirements. Is able to identify risks in security systems and work with technical experts to resolve security issues. Possess ability to identify key concepts, factors and risks based on conversations and document these in clear and concise narrative or graphic reports.

Five (5) or more years IT/security experience.

Bachelor of Science or equivalent military or commercial experience.

Fulcrum IT Services, LLC GS-35F-0480W Page 15 of 108

Cybersecurity Senior Administrator

Works on complex information assurance (IA) projects involving all phases of information assurance and network operations to include: assess, remediate, correlate, analyze, and provide

IA course of action decision support. Reviews security-related documents (e.g., System

Architecture; Authentication & Authorization designs, etc.) to ensure compliance with NIST SP

800 guidance, federal law, organizational policy and best practices security guidelines/requirements. Identifies risks in security systems and work with technical experts to resolve security issues. Possess ability to identify key concepts, factors and risks based on conversations and document these in clear and concise narrative or graphic reports.

Minimum/General Experience:

A Cybersecurity Senior Administrator must demonstrate at least six (6) years of experience.

Three (3) years should be specialized experience. The remainder may be any combination of specialized and/or general experience. A history of multiple complex IT environments and experience is desired.

Minimum Education:

Generally requires a Bachelor’s degree in Computer Science, Cybersecurity, Information

Systems, Engineering, Business, or other related discipline with 4 to 6 years of experience. A

Master’s degree with 2 to 4 years.

Applicable Training: (If Any)

Cyber Senior Functional Analyst

Defines, designs, and specifies processes and procedures for developing complex cyber-related information systems. Chief Designer during the system development life cycle. Defines the documentation requirements.

Minimum/General Experience:

Fourteen years IT systems experience, with ten of the fourteen using structured analytical and programming techniques at the systems level, as well as developing and implementing advanced techniques and procedures. Sought as a recognized expert in requirements definition, conceptualizing system design, evaluating alternatives, and selecting final solutions. Expert in the use and development of integrated CASE Tools for requirements analysis and system design.

At least five years managing and directing the efforts of other analysts. Recognized nationally as an expert in the field.

Minimum Education:

Bachelor’s degree in computer science, related technical field. Advanced degree is desirable, as is being recognized in the field as an expert. Three (3) years of applicable experience may be substituted for a degree.

Fulcrum IT Services, LLC GS-35F-0480W Page 16 of 108

Cyber Senior Management Analyst

Provides management analysis and policy analysis in support of cyber-related feasibility studies and requirements analyses. Supports activity and data modeling, development of modern business methods, identification of best practices, and creating and assessing performance measurements. Provides group facilitation, interviewing, training, and additional forms of knowledge transfer. Key coordinator between customers and multiple project teams to ensure enterprise-wide integration of reengineering efforts and application of best practice including e-business practices experience.

Five (5) or more years IT/management experience.

Cybersecurity Administrator

Works on information assurance (IA) projects involving all phases of information assurance and network operations to include: assess, remediate, correlate, analyze, and provide IA course of action decision support. Reviews security-related documents (e.g., System Architecture;

Authentication & Authorization designs, etc.) to ensure compliance with NIST SP 800 guidance, federal law, organizational policy and best practices security guidelines/requirements. Identifies risks in security systems and work with technical experts to resolve security issues. Possess ability to identify key concepts, factors and risks based on conversations and document these in clear and concise narrative or graphic reports.

Minimum/General Experience:

A Cybersecurity Admin must demonstrate at least four (4) years of experience. Two (2) year should be specialized experience. The remainder may be any combination of specialized and/or general experience.

Minimum Education:

Generally requires a Bachelor’s degree in Computer Science, Cybersecurity, Information

Systems, Engineering, Business, or other related discipline with 2 years of experience. A

Master’s degree with 1 year.

Applicable Training: (If Any)

Cyber Intermediate Information Assurance Analyst

Fulcrum IT Services, LLC GS-35F-0480W Page 17 of 108

Works on complex information assurance (IA) cyber-related projects involving all phases of information assurance and network operations to include: assess, address, correlate, analyze, and provide IA course of action decision support. Reviews security-related documents (e.g., System

Architecture; Authentication & Authorization designs, etc.) to ensure compliance with federal

(e.g., NIST) and organization-specific security guidelines/requirements. Is able to identify risks in security systems and work with technical experts to resolve security issues. Possess ability to identify key concepts, factors and risks based on conversations and document these in clear and concise narrative or graphic reports.

Three (3) or more years IT/security experience.

Cyber Senior Application Engineer

Applies disciplines to reengineer methodologies/ principles. Develops analytical and computational techniques and methodology for cyber-related problem solutions. Performs strategic systems planning, business information planning, business, and analysis. Performs process and data modeling.

Minimum/General Experience:

Eight (8) years' experience in information systems development, functional and data requirements analysis, systems analysis and design, programming, program design, and documentation preparation.

Minimum Education:

Bachelor’s degree in computer science, related technical field. Three (3) years of applicable experience may be substituted for a degree.

Fulcrum IT Services, LLC GS-35F-0480W Page 18 of 108

Cyber Administrative Services, Lead

Individual provides a wide range of administrative and technical assistance. A Lead

Administrative Services individual has acquired some managerial capability. Can execute projects within experience level. Receives and reviews completed products and reviews for administrative sufficiency. Monitors and tracks actions to remind responsible officials of suspense actions due. Designs and maintains spreadsheets, databases, and word processing business graphics applications. The individual uses graphics software to present data in graphic form and develops familiarity with new software packages for ease of use and applicability to support requirements.

Minimum/General Experience:

Competent in most phases of an operation; assists in dealing with problems. Over six (6) years of general experience, possesses proficiency to operate standard office machines such as personal computers, printers, copiers, and standard software applications (Microsoft

Word/Excel/PowerPoint and Adobe PDF files). The individual should possess a general knowledge base for handling all types of technical material including recommendations, reports, view-graphs, tables, charts, and documentation.

Minimum Education:

Bachelor degree with 0 to 2 years of related experience. With no degree 6 to 8 years. A high school diploma or equivalent; general information technology, vocational or college business courses can serve as a substitute of one year’s required experience (one month for one month).

WAGE DETERMINATION DETAIL FOR SIN 132-45D

FULCRUM LCAT TITLE

WAGE DETERMINATION

CATEGORY

OCCUPATION

CODE

Cyber Administrative Services, Lead Secretary III 01313

Wage Determination information reflects #05-2103 (Rev. -16) dated 7/14/2015 covering

District of Columbia, Maryland and Virginia.

Fulcrum IT Services, LLC GS-35F-0480W Page 19 of 108

TERMS AND CONDITIONS APPLICABLE TO INFORMATION

TECHNOLOGY (IT) PROFESSIONAL SERVICES (SPECIAL ITEM NUMBER

132-51)

****NOTE: All non-professional labor categories must be incidental to, and used solely to support professional services, and cannot be purchased separately.

1. SCOPE

a. The prices, terms and conditions stated under Special Item Number 132-51

Information Technology Professional Services apply exclusively to IT Professional Services within the scope of this Information Technology Schedule.

b. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2. PERFORMANCE INCENTIVES I-FSS-60 Performance Incentives (April 2000)

a. Performance incentives may be agreed upon between the Contractor and the ordering activity on individual fixed price orders or Blanket Purchase Agreements under this contract.

b. The ordering activity must establish a maximum performance incentive price for these services and/or total solutions on individual orders or Blanket Purchase Agreements.

c. Incentives should be designed to relate results achieved by the contractor to specified targets. To the maximum extent practicable, ordering activities shall consider establishing incentives where performance is critical to the ordering activity’s mission and incentives are likely to motivate the contractor. Incentives shall be based on objectively measurable tasks.

3. ORDER

a. Agencies may use written orders, EDI orders, blanket purchase agreements, individual purchase orders, or task orders for ordering services under this contract. Blanket Purchase

Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal

Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

4. PERFORMANCE OF SERVICES

Fulcrum IT Services, LLC GS-35F-0480W Page 20 of 108

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity.

b. The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of IT Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all

Contractor travel. Contractors cannot use GSA city pair contracts.

5. STOP-WORK ORDER (FAR 52.242-15) (AUG 1989)

(a) The Contracting Officer may, at any time, by written order to the Contractor, require the Contractor to stop all, or any part, of the work called for by this contract for a period of 90 days after the order is delivered to the Contractor, and for any further period to which the parties may agree. The order shall be specifically identified as a stop-work order issued under this clause. Upon receipt of the order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the order during the period of work stoppage. Within a period of 90 days after a stop-work is delivered to the Contractor, or within any extension of that period to which the parties shall have agreed, the Contracting Officer shall either-

(1) Cancel the stop-work order; or

(2) Terminate the work covered by the order as provided in the Default, or the

Termination for Convenience of the Government, clause of this contract.

(b) If a stop-work order issued under this clause is canceled or the period of the order or any extension thereof expires, the Contractor shall resume work. The Contracting Officer shall make an equitable adjustment in the delivery schedule or contract price, or both, and the contract shall be modified, in writing, accordingly, if-

(1) The stop-work order results in an increase in the time required for, or in the

Contractor's cost properly allocable to, the performance of any part of this contract;

and

(2) The Contractor asserts its right to the adjustment within 30 days after the end of the period of work stoppage; provided, that, if the Contracting Officer decides the facts justify the action, the Contracting Officer may receive and act upon the claim submitted at any time before final payment under this contract.

Fulcrum IT Services, LLC GS-35F-0480W Page 21 of 108

(c) If a stop-work order is not canceled and the work covered by the order is terminated for the convenience of the Government, the Contracting Officer shall allow reasonable costs resulting from the stop-work order in arriving at the termination settlement.

(d) If a stop-work order is not canceled and the work covered by the order is terminated for default, the Contracting Officer shall allow, by equitable adjustment or otherwise, reasonable costs resulting from the stop-work order.

6. INSPECTION OF SERVICES

In accordance with FAR 52.212-4 CONTRACT TERMS AND CONDITIONS--

COMMERCIAL ITEMS (MAR 2009) (DEVIATION I - FEB 2007) for Firm-Fixed Price orders and FAR 52.212-4 CONTRACT TERMS AND CONDITIONS −COMMERCIAL

ITEMS (MAR 2009) (ALTERNATE I − OCT 2008) (DEVIATION I – FEB 2007) applies to

Time-and-Materials and Labor-Hour Contracts orders placed under this contract.

7. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then

FAR 52.227-14 (Dec 2007) Rights in Data – General, may apply.

8. RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite IT Professional Services.

9. INDEPENDENT CONTRACTOR

All IT Professional Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

10. ORGANIZATIONAL CONFLICTS OF INTEREST

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the

Fulcrum IT Services, LLC GS-35F-0480W Page 22 of 108

Contractor or its affiliates or (ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the

Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR

9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

11. INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for IT Professional services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

12. PAYMENTS

For firm-fixed price orders the ordering activity shall pay the Contractor, upon submission of proper invoices or vouchers, the prices stipulated in this contract for service rendered and accepted. Progress payments shall be made only when authorized by the order. For time-and-materials orders, the Payments under Time-and-Materials and Labor-Hour Contracts at FAR

52.212-4 (MAR 2009) (ALTERNATE I – OCT 2008) (DEVIATION I – FEB 2007) applies to time-and-materials orders placed under this contract. For labor-hour orders, the Payment under

Time-and-Materials and Labor-Hour Contracts at FAR 52.212-4 (MAR 2009) (ALTERNATE I

– OCT 2008) (DEVIATION I – FEB 2007) applies to labor-hour orders placed under this contract. 52.216-31(Feb 2007) Time-and-Materials/Labor-Hour Proposal Requirements—

Commercial Item Acquisition As prescribed in 16.601(e)(3), insert the following provision:

(a) The Government contemplates award of a Time-and-Materials or Labor-Hour type of contract resulting from this solicitation.

(b) The offeror must specify fixed hourly rates in its offer that include wages, overhead, general and administrative expenses, and profit. The offeror must specify whether the fixed hourly rate for each labor category applies to labor performed by—

(1) The offeror;

(2) Subcontractors; and/or

(3) Divisions, subsidiaries, or affiliates of the offeror under a common control.

13. RESUMES

Fulcrum IT Services, LLC GS-35F-0480W Page 23 of 108

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

14. INCIDENTAL SUPPORT COSTS

Incidental support costs are available outside the scope of this contract. The costs will be negotiated separately with the ordering activity in accordance with the guidelines set forth in the FAR.

15. APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity's

Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

16. DESCRIPTION OF IT PROFESSIONAL SERVICES

LABOR CATEGORY DESCRIPTIONS – SIN 132-51

Commercial Job Title: Program Manager

Functional Responsibility: Capabilities/Duties: Demonstrated experience and ability to direct multiple IT systems development life cycle (SDLC) efforts such as: design, development, integration, testing, training, deployment, operation and/or maintenance. Must be capable of independently leading programs that involve the successful management of teams composed of data processing and other information management professionals who have been involved in analysis, design, integration, testing, documenting, converting, extending, and implementing automated information systems. Performs day-to-day management of overall contract support operations, possibly involving multiple projects and groups of personnel at multiple locations.

Organizes, directs, and coordinates the planning and production of all contract support activities.

Demonstrates written and oral communication skills. Ability and authority to establish and alter

(as necessary) vendor management structure to direct effective contract support activities.

Minimum/General Experience: BA or BS and 10 years of experience in program management with 5 years specifically designated as a PgM on similar contracts in terms of size, complexity, and team composition and depth. An advanced degree may decrease years of experience in program management and years on a similar contract to 8 and 4 respectively. PGMP a plus.

Minimum Education: BA or BS

Applicable Training: 10 years of experience in program management with 5 years specifically designated as a PgM.

Fulcrum IT Services, LLC GS-35F-0480W Page 24 of 108

Commercial Job Title: Project Manager

Functional Responsibility: Capabilities/Duties: Demonstrated experience and ability to oversee and orchestrate IT systems development life cycle (SDLC) efforts such as: design, development, integration, testing, training, deployment, operation and/or maintenance. Performs day-to-day management of assigned delivery order projects that involve teams of data processing and other information system and management professionals who have previously been involved in analyzing, designing, integrating, testing, documenting, converting, extending, and implementing automated information systems. Demonstrates proven skills in those technical areas addressed by the delivery order to be managed. Organizes, directs, and coordinates the planning and production of all activities associated with assigned delivery order projects, including assessment of staff and expenditure of ODCs. Demonstrates writing and oral communication skills.

Minimum/General Experience: BA or BS and 10 years of experience in project management with 5 years specifically designated as a PjM on similar contracts in terms of size, complexity, and team composition and depth. An advanced degree may decrease years of experience in project management and years on a similar contract to 8 and 4 respectively. PMP a plus.

Applicable Training: 5 years of experience managing comparable tasks on similar contracts in terms of size.

Commercial Job Title: Task Manager

Functional Responsibility: Capabilities/Duties: Demonstrated experience and ability to directly supervise an individual IT systems development life cycle (SDLC) task such as: design, development, integration, testing, training, deployment, operation and/or maintenance. Performs day-to-day management of assigned tasks, working with other data processing or information system and management professionals. Demonstrates proven skills in those technical areas addressed by the task to be managed. Plans, organizes, coordinates and executes all activities associated with assigned task. Demonstrates writing and oral communication skills.

Minimum/General Experience: BA or BS and 5 years…