MAS - VMD Systems Integrators, Inc. - GS35F0633P

FSC/PSC Class: 0000 and D399

For more information on ordering from Federal Supply Schedules go to the GSA Schedules page at GSA.gov.

Contract Period: June 30, 2019 – June 29, 2024 (Price list current through modification PA-0048 and PS-A812 signed June 8, 2020)

Contract Number: GS-35F-0633P

Size: VMD is a Small Business and a Woman-Owned Small Business

Contractor Contact Information

VMD Corp Sabrina Brown-Diallo 4114 Legato Road, Suite 700 Fairfax, VA 22033 www.vmdcorp.com Telephone: 571.612.2431 sbrown-diallo@vmdcorp.com

General Services Administration

Federal Acquisition Service Authorized Federal Supply Schedule Price List

Multiple Award Schedule – MAS On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order are available through GSA Advantage!®, a menu-driven database system. The

Internet address GSA Advantage!® is: GSAAdvantage.gov.

http://www.vmdcorp.com/ mailto:sbrown-diallo@vmdcorp.com

GSA MAS Contract #: GS-35F-0633P Table of Contents i

Table of Contents

1.0 CUSTOMER INFORMATION

1.1. GENERAL INFORMATION

1.1.1. Awarded Special Item Numbers (SINs)

1.1.2. Lowest Priced Model Number and Lowest Unit Price

1.1.3. Hourly Rates and Descriptions

1.1.4. Maximum order

1.1.5. Minimum order

1.1.6. Geographic Coverage

1.1.7. Point(s) of Production

1.1.8. Discount From List Prices or Statement of Net Price

1.1.9. Quantity Discounts

1.1.10. Prompt Payment Terms

1.1.11. Foreign Items

1.1.12. Delivery Time Related Items

1.1.13. F.O.B. Point(s)

1.1.14. Ordering

1.1.15. Payment Address

1.1.16. Warranty Provision

1.1.17. Export Packing Charges

1.1.18. Terms and Conditions of Rental, Maintenance, and Repair

1.1.19. Terms and Conditions of Installation

1.1.20. Terms and Conditions of Repair Parts Indicating Date of Parts Price Lists and Any Discounts From List Prices

1.1.21. Terms and Conditions For Any Other Services

1.1.22. List of Service and Distribution Points

1.1.23. List of Participating Dealers

1.1.24. Preventive Maintenance

1.1.25. Special Attributes Such as Environmental Attributes

1.1.26. Section 508 Compliance

1.1.27. Data Universal Number System (DUNS) Number

1.1.28. Notification Regarding Registration in System for Award Management (SAM) database 4

2.0 DESCRIPTION OF HIGHLY ADAPTIVE CYBERSECURITY SERVICES - SIN

54151HACS (FORMERLY SIN 132-45)

2.1. OVERVIEW

2.2. EDUCATION/EXPERIENCE SUBSTITUTIONS

2.3. LABOR CATEGORY DESCRIPTIONS

2.4. PRICING OF HIGHLY ADAPTIVE CYBERSECURITY SERVICES - SIN 54151HACS

(FORMERLY SIN 132-45)

2.5. TERMS AND CONDITIONS APPLICABLE TO HIGHLY ADAPTIVE CYBERSECURITY SERVICES

(HACS) SPECIAL ITEM NUMBER 54151HACS

2.5.1. Scope

2.5.2. Order

GSA MAS Contract #: GS-35F-0633P Table of Contents ii

2.5.3. Performance Of Services

2.5.4. Inspection Of Services

2.5.5. Responsibilities Of The Contractor

2.5.6. Responsibilities Of The Ordering Activity

2.5.7. Independent Contractor

2.5.8. Organizational Conflicts Of Interest

2.5.9. Invoices

2.5.10. Resumes

2.5.11. Approval Of Subcontracts

2.5.12. Description Of Highly Adaptive Cybersecurity Services And Pricing

3.0 DESCRIPTIONS OF INFORMATION TECHNOLOGY PROFESSIONAL

SERVICES - SIN 54151S (FORMERLY SIN 132-51)

3.1. LABOR CATEGORY DESCRIPTIONS

3.2. TERMS AND CONDITIONS APPLICABLE TO INFORMATION TECHNOLOGY PROFESSIONAL

SERVICES – SIN 54151S (FORMERLY SIN 132-51)

3.2.1. Scope

3.2.2. Instructions

3.2.3. Additional Terms and Conditions

3.3. PRICING OF INFORMATION TECHNOLOGY PROFESSIONAL SERVICES - SIN 54151S

(FORMERLY SIN 132-51)

4.0 TERMS AND CONDITIONS APPLICABLE TO OLM (ORDER-LEVEL

MATERIALS) SIN (FORMERLY ORDER-LEVEL MATERIALS SIN 70-500)

4.1. SCOPE

4.2. INSTRUCTIONS

GSA MAS Contract #: GS-35F-0633P 1

1.0 CUSTOMER INFORMATION

1.1. General Information

1.1.1. Awarded Special Item Numbers (SINs)

Large Category Subcategory

Special Item Number

(SIN) SIN Description

Item Description

Page

Item Price Page

Information Technology

IT Services SIN

54151HACS

Highly Adaptive Cybersecurity Services (HACS) including Subcategories: High Value Asset (HVA) Assessments, Risk and Vulnerability Assessments (RVA), Cyber Hunt, Incident Response, and Penetration Testing (formerly SIN 132- 45: Highly Adaptive Cybersecurity Services.)

Pages 5-12

Pages 13-14

Information Technology

IT Services SIN 54151S Information Technology Professional Services (formerly SIN 132-51: IT Professional Services)

Pages 19-25 Page

Miscellaneous Complimentary

SIN

SIN OLM Order-Level Materials (formerly SIN 70-500: Order-Level Materials)

Pages 30-32 N/A

1.1.2. Lowest Priced Model Number and Lowest Unit Price

Identification of the lowest priced model number and lowest unit price for that model for each special item number awarded in the contract. This price is the Government price based on a unit of one, exclusive of any quantity/dollar volume, prompt payment, or any other concession affecting price. Those contracts that have unit prices based on the geographic location of the customer, should show the range of the lowest price, and cite the areas to which the prices apply.

Not Applicable.

1.1.3. Hourly Rates and Descriptions

If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles, experience, functional responsibility and education for those types of employees or subcontractors who will perform services shall be provided. If hourly rates are not applicable, indicate “Not applicable” for this item.

SIN 54151HACS: See pages 5-14 SIN 54151S: See pages 19-29 SIN OLM: Not Applicable.

1.1.4. Maximum order

SIN Number Maximum Order

SIN 54151HACS $500,000

SIN 54151S $500,000

SIN OLM $250,000

1.1.5. Minimum order

The minimum dollar value of an order for delivery to one destination is $100.00

GSA MAS Contract #: GS-35F-0633P 2

1.1.6. Geographic Coverage

Domestic Delivery Only—The geographic scope of this contract is the 48 contiguous states, Alaska, Hawaii, Puerto Rico, Washington DC, and U.S. Territories.

1.1.7. Point(s) of Production

Not Applicable.

1.1.8. Discount From List Prices or Statement of Net Price

None.

1.1.9. Quantity Discounts

None.

1.1.10. Prompt Payment Terms

Net 30. Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions.

1.1.11. Foreign Items

Not Applicable.

1.1.12. Delivery Time Related Items

1.1.12.1. Time of delivery

As negotiated between the Contractor and the Ordering Activity.

1.1.12.2. Expedited Delivery

Items available for expedited delivery are noted in this price list.

1.1.12.3. Overnight and 2-day delivery

Contact the contractor.

1.1.12.4. Urgent Requirements

When the Federal Supply Schedule contract delivery period does not meet the bona fide urgent delivery requirements of an ordering agency, ordering agencies are encouraged, if time permits, to contact the Contractor for the purpose of obtaining accelerated delivery. The Contractor shall reply to the inquiry within 3 workdays after receipt. (Telephonic replies shall be confirmed by the Contractor in writing.) If the Contractor offers an accelerated delivery time acceptable to the ordering agency, any orders(s) placed pursuant to the agreed upon accelerated delivery time frame shall be delivered within this shorter delivery time and in accordance with tall other terms and conditions of the contract.

The ordering agency may also contact the Contractor's Representative to affect a faster delivery.

1.1.13. F.O.B. Point(s)

Destination

1.1.14. Ordering

1.1.14.1. Ordering address

GSA MAS Contract #: GS-35F-0633P 3

Sabrina Brown-Diallo (Contracts Manager) VMD Corp 4114 Legato Road, Suite 700 Fairfax, VA 22033 sbrown-diallo@vmdcorp.com Office: 571-612-2431

1.1.14.2. Ordering Procedures

For supplies and services, the ordering procedures, information on Blanket Purchase Agreements (BPA’s) are found in Federal Acquisition Regulation (FAR) 8.405-3.

1.1.15. Payment Address

VMD Corp 4114 Legato Road, Suite 700 Fairfax, VA 22033

1.1.16. Warranty Provision

Not Applicable.

1.1.17. Export Packing Charges

Not Applicable.

1.1.18. Terms and Conditions of Rental, Maintenance, and Repair Not Applicable.

1.1.19. Terms and Conditions of Installation

Not Applicable.

1.1.20. Terms and Conditions of Repair Parts Indicating Date of Parts Price Lists and

Any Discounts From List Prices Not Applicable.

1.1.21. Terms and Conditions For Any Other Services

Not Applicable.

1.1.22. List of Service and Distribution Points

Not Applicable.

1.1.23. List of Participating Dealers

Not Applicable.

1.1.24. Preventive Maintenance

Not Applicable.

1.1.25. Special Attributes Such as Environmental Attributes

mailto:sbrown-diallo@vmdcorp.com

GSA MAS Contract #: GS-35F-0633P 4

Not Applicable.

1.1.26. Section 508 Compliance

If applicable, indicate that Section 508 compliance information is available on Electronic and Information Technology (EIT) supplies and services and show where full details can be found (e.g.

contractor’s website or other location.) The EIT standards can be found at: www.Section508.gov/

1.1.27. Data Universal Number System (DUNS) Number

118324461

1.1.28. Notification Regarding Registration in System for Award Management (SAM) database VMD Systems Integrators, Inc. (DBA VMD Corp.) is registered in the System for Award Management (SAM) Database.

GSA MAS Contract #: GS-35F-0633P 5

2.0 DESCRIPTION OF HIGHLY ADAPTIVE CYBERSECURITY

SERVICES - SIN 54151HACS (FORMERLY SIN 132-45)

2.1. Overview

VMD’s SIN54151HACS labor categories are mapped to the Office of Management and Budget’s (OMB) Standard Occupational Classification (SOC) for which the Bureau of Labor Statistics (BLS) maintains compensation data. Labor categories may be further subdivided by knowledge/skill level. Definitions of these knowledge/skill levels are as follows:

• Junior: Applies fundamental concepts, processes, practices, and procedures on technical assignments. Performs work that requires practical experience and training. Work is performed under supervision. 0-2 years’ experience with an Associate Degree or equivalent certifications.

• Journeyman: Possesses and applies expertise on multiple complex work assignments.

Assignments may be broad in nature, requiring originality and innovation in determining how to accomplish tasks. Operates with appreciable latitude in developing methodology and presenting solutions to problems. Contributes to deliverables and performance metrics where applicable. 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

• Senior: Possesses and applies a comprehensive knowledge across key tasks and high impact assignments. Plans and leads major technology assignments. Evaluates performance results and recommends major changes affecting short-term project growth and success. Functions as a technical expert across multiple project assignments. May supervise others. 5-8 years’ experience with a bachelor’s degree or equivalent certifications.

• Lead: Provides technical/management leadership on major tasks or technology assignments. Establishes goals and plans that meet project objectives. Has domain and expert technical knowledge. Directs and controls activities for a client, having overall responsibility for financial management, methods, and staffing to ensure that technical requirements are met. Interactions involve client negotiations and interfacing with senior management. Decision-making and domain knowledge may have a critical impact on overall project implementation. May supervise others. 8 years’ experience with a Master’s degree or equivalent certifications.

2.2. Education/Experience Substitutions

The following presents the allowable substitutions based on education and experience:

• Two (2) year experience (in addition to minimum experience requirements) may be substituted for a Associates’ degree.

• Four (4) years' experience (in addition to minimum experience requirements) may be substituted for a Bachelor's degree.

• Two (2) years' experience (in addition to minimum experience requirements and Bachelor's degree) may be substituted for a Master's degree.

GSA MAS Contract #: GS-35F-0633P 6

• For categories where a Bachelor's degree is required, a Master's degree may be substituted for two (2) years' experience; or a doctoral degree may be substituted for three (3) years' experience.

• Successful completion of each course in specialized or emerging technology (Windows Oracle, PowerBuilder, Web development, internet/intranet security, and XML, etc.) may be substituted for one year of experience.

2.3. Labor Category Descriptions

Labor Category:

Program Manager

Functional Description:

Serve as the program manager responsible for organizing, directing, and managing all aspects of contract operational support functions involving multiple complex and inter-related project tasks that often require managing teams of contractor personnel at multiple locations. Provide overall direction of program activities. Manage and maintain contractor interface with the senior levels of the customer’s organization. Consult with customer and contractor personnel to formulate and review task plans and deliverables, ensuring conformance with program and project task schedules, costs, contractual obligations. Establish and maintain technical and financial reports to show progress of projects to management and customers, organize and assign responsibilities to subordinates, oversee the successful completion of all assigned tasks, and assume the initiative and provide support to marketing personnel in identifying and acquiring potential business.

Education and Experience:

Minimum 10 years’ experience with a master’s degree or equivalent certifications.

Labor Category:

Chief Information Security Officer

Functional Description:

Responsible for determining enterprise information security standards. Lead the development and implementation of information security standards and procedures. Provide tactical information security advice and examining the ramifications of new technologies. Ensure that all information systems are functional and secure.

Education and

Minimum 10 years’ experience with a master’s degree or equivalent certifications.

Project Manager

Functional Description:

Work directly with the government customer, who establishes direction, priorities, and provides overall operational guidance. Provide direct support and advice to the government customer and Federal team. Manage project scope, deliverables, and schedule. Manage work of all contractor and subcontract staff assigned to the Contract such that activities and deliverables are completed on time and to the customer’s satisfaction. Directly oversee and participate in activities requiring senior technical and management skills, as appropriate. Assists the with tasks associated with formal meetings, (e.g., establishment of agenda, meeting minutes, tracking status of action items and deliverables, etc.). Prepare and submit all required reports to Contract Officer (CO) and COR. Apply project methodology (such as, scoping, planning, designing, building, deploying, and closing out project) using critical thinking and leadership skills. Assist in responding to data calls from senior leadership, Agency offices, the GAO, OMB, OIG, and other Federal Agencies.

GSA MAS Contract #: GS-35F-0633P 7

Education and Experience:

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Senior – 5-8 years’ experience with a bachelor’s degree or equivalent certifications.

Lead – Minimum 8 years’ experience with a master’s degree or equivalent certifications.

Cyber Security Subject Matter Expert (SME)

Provide technical knowledge and analysis of highly specialized applications and operational environment, high-level functional systems analysis, design, integration, documentation and implementation advice on moderately complex problems that require an appropriate level of knowledge of the subject matter for effective implementation. Apply principles, methods and knowledge of the functional area of capability to specific task order requirements, advanced principles and methods to exceptionally difficult and narrowly defined technical problems in engineering and other scientific applications to arrive at automated solutions. Assist other senior consultants with analysis and evaluation and with the preparation of recommendations for system improvements, optimization, development, and/or maintenance efforts in the following specialties: systems security architecture, secure networking, automation, security policy, and risk management. Commensurate experience in IT and in new and related older technology that directly relates to the required area of expertise.

Education and Experience:

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Cyber Security Architect

Establish system information security requirements using analysis in the development of enterprise-wide or large-scale information systems. Determine and identify high level functional and technical requirements based on interactions with the user community and knowledge of the enterprise architecture. Design security architecture to include the software, hardware and communications to support the total requirements as well as provide for present and future cross-functional requirements and interfaces. Identify, assess, and present options for meeting the functional and technical requirements including hardware and software updates or upgrades. Be responsible for developing high level system design diagrams. Ensure these systems are compatible and in compliance with the standards for open systems architectures, the agency and OCIO architectures, and the Open Systems Interconnection (OSI) as they apply to the implementation and specification of Information Management (IM) solution of the application platform, across the application program interface (API), and the external environment/software application. Ensure that the common operating environment is compliant;

evaluate analytically and systematically problems of workflows, organization and planning and develops appropriate corrective action; Provide daily supervision and direction to staff. Create and assist in the creation of planned maturation of OCIO’s technical capabilities aligned to agency and OCIO’s strategic goals. Support Systems Security Architecture design and implementation of solutions’ infrastructure, configuration, prototypes and production deployment and handoff. Support the enterprise management framework by complying with the Technical Reference Model (TRM). Support the agency ICAM solution project framework including planning, designing, developing, and implementing the solutions. Participate in the creation of technical demos, briefings, and oral presentations materials. Provide Technical thought leadership and SME value to client interactions. Create strategies for developing win themes and addressing business challenges and opportunities uniquely and distinctly.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

GSA MAS Contract #: GS-35F-0633P 8

Cyber Security Software Developer

Analyze and study complex system requirements. Design software tools and subsystems to support software reuse and domain analyses and manages their implementation. Manage software development and support using formal specifications, data flow diagrams, secure coding principals, other accepted design techniques and Computer Aided Software Engineering (CASE) tools. Estimate software development costs and schedule. Review existing programs and assist in making refinements, reducing operating time, and improving current techniques.

Supervise software configuration management.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Cyber Security Test Engineer

Conduct and/or support authorized penetration testing on enterprise network assets. Create penetration test documentation including Rules of Engagements and penetration testing reports.

Maintain deployable cyber defense audit toolkit (e.g., specialized cyber defense software and hardware) to support cyber defense audit missions. Maintain knowledge of applicable cyber defense policies, regulations, and compliance documents specifically related to cyber defense auditing. Prepare audit reports that identify technical and procedural findings, and provide recommended remediation strategies/solutions. Perform technical (evaluation of technology) and nontechnical (evaluation of people and operations) risk and vulnerability assessments of relevant technology focus areas (e.g., local computing environment, network and infrastructure, enclave boundary, supporting infrastructure, and applications). Make recommendations regarding the selection of cost-effective security controls to mitigate risk (e.g., protection of information, systems and processes). Research new threats, attack vectors, and risk. Analyze results of scans to identify threats and vulnerabilities, analyze controls planned or already in place, determine the likelihood that identified vulnerabilities may be exploited by testing exploitation, and provide an analysis which includes recommended remediation strategies for comprehensive security program improvements. Validate findings and research methods for mitigation when deemed necessary by the agency. This includes retesting findings to validate vulnerability remediation and/or gathering information to assist system owners with the mitigation of findings.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Cyber Threat Analyst

Conduct all-source analysis, digital forensics, and targeting to identify, monitor, assess, and counter the threat posed by malicious actors against agency information systems, critical infrastructure, and cyber-related interests. Prepare and coordinate strategic, high-level Cyber Threat assessments, and provide tactical analysis, advice, and information concerning adversary cyber actions and capabilities to the Government. Use all-source analysis and all available disciplines to research, draft, and submit information to the Government. Collaborate with government and contractor cyber threat analysts to satisfy requests for information from stakeholders throughout the agency enterprise as well as with external partners and stakeholders including but not limited to DHS, US-CERT, OMB, GAO, OIG, and law enforcement. Submit

GSA MAS Contract #: GS-35F-0633P 9 assessments on trending topics in Cyberspace SOC leadership review, approval, and distribution. Develop and present to senior decision / policymakers agency-relevant briefing on threats to the agency Information Environment. Apply scientific and technical knowledge to solving complex problems, produce short-term and long-term written assessments, and brief decision makers. This work demands initiative, creativity, analytic skills, and technical expertise. Participate in cyberspace-related, community of interests and present key technical intelligence to senior decision/policymakers.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Security Analyst

Conduct Intrusion Detection Monitoring Operations. Monitor all agency networks and perimeter boundaries to wider networks. Review and analyze sensor data provided by agency Cybersecurity Automated Systems. Use correlated data analysis to identify unauthorized activity detected by Cybersecurity Automated Systems. Conduct near real-time review of logs when a security event is detected. Search for and report distributed, long-term, coordinated, low-visibility network-based attacks across agency networks to identify possible unauthorized activity. Follow formal procedures for creating and distributing warnings and notifications to the agency. Provide interim guidance and countermeasures to defend against identified threats.

Review, and when appropriate recommend/update network/system configuration or rule sets in response to changes in the threat environment and notify the agency. Distribute formal guidance to ISOs that support best practices for security configuration.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Security Awareness Training Specialist

Provide support for coordinating, developing, and delivering computer-related security training to the user community. Provide second level support and coordinate training with help desks.

Provide standards, services, and guidance on IT related training programs that are designed to enable government agency personnel to use information technologies and systems more productively. Services include the development, delivery, and/or coordination of training courses and materials that address specific agency needs. Possess thorough knowledge of appropriate hardware and software (ex. - PCs, Microsoft (MS) Windows). Understand computer functions and related technical terminology and how they are applied in everyday business situations. Possess exceptional interpersonal skills and superior oral and written communication skills.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Cyber Security Information Security Engineer

Coordinate and/or perform additions and changes to network hardware and operating systems, and attached devices; including investigation, analysis, recommendation, configuration, GSA MAS Contract #: GS-35F-0633P 10 installation, and testing of new network hardware and software. Provide direct support in the day-to-day operations on network hardware and operating systems including the evaluation of system utilization, monitoring response time and primary support for detection and correction of operational problems. Troubleshoot at the physical level of the network, working with network measurement hardware and software, as well as physical checking and testing of hardware devices at the logical level working with communication protocols. Participate in planning design, technical review and implementation for new network infrastructure hardware and network operating systems for voice and data communication networks. Maintain network infrastructure standards including network communication protocols such as TCP/IP. Provide technical consultation, training and support to IT staff as designated by the government.

Diagnose and resolve complex communication problems.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Cyber Security Systems Analyst

Provide technical and administrative direction for personnel performing software development tasks, including the review of work products for correctness, adherence to the design concept and to user standards, and for progress in accordance with schedules. Coordinate with the Project and/or Program Manager to ensure problem solution and user satisfaction. Make recommendations, if needed, for approval of major systems installations. Prepare milestone status reports and deliveries/presentations on the system concept to colleagues, subordinates, and end user representatives. Provide daily supervision and direction to support staff.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Information Systems Security Officer

Develop and maintain all security documentation for systems under their purview. These documents shall include but are not limited to Privacy Threshold Analysis (PTA), Privacy Impact Assessments (PIA), System of Record Notices (SORNs), System Categorization, System Security Plans (SSP), Business Impact Assessments (BIA), Contingency Plan and Tests (CP and CPT), Security Authorization Briefing, Recommendation, Memo.

Provide support for:

• System-level policies, processes, and procedures development, review, and updates

• Management of FISMA Inventory

• POA&M Management

• Risk Management

• Security Awareness & IT Role-Based Training Tracking

• Audit Support

• Security and Privacy-Related Data Call Support

• System Security Lifecycle Support

• Security Assessment & Authorization (SAA) System Owner Document Creation and Updates

• Continuous Monitoring System Owner Document Creation and Updates

• Review Change Requests (CR) to ensure that new systems include the appropriate security requirements at all phases of the SDLC.

• Complete Security Impact Analysis of changes as part of the CR process to ensure that the change will not have a negative impact to the OCIO GSS.

GSA MAS Contract #: GS-35F-0633P 11

• Ensure analysis is completed within the timeframes outlined for CRs and Security Impact Analysis

Assist system owner and agency security stakeholders in capturing all system weaknesses in POA&Ms. Notify the Enterprise Security Operations Center (ESOC) of actual or suspected computer security incidents, including PH and/or PHI breaches. Assist the ESOC and System Owner on all IT security and privacy incident reporting and subsequent resolution/remediation.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Network Security Administrator

Perform the daily activities of configuration and operation of systems which may be mainframe, mini, or client/server based. Perform the optimizing of system operation and resource utilization and perform system capacity analysis and planning. Provide assistance to users in accessing and using business systems. Commensurate experience and education.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Disaster Recovery Analyst

Previous experience in business recovery or disaster recovery planning required. General knowledge of business processes, management structures, and technology programs/platforms are preferred. Strong verbal and written communications skills are desirable. Provide support in the development of a government agencies emergency management and business recovery plans; perform functions pertaining to the agencies business risk assessments; review and develop business recovery strategies; draft procedures for identifying failures and invoking contingency plans; create response procedures and identifying communications channels;

communicate with various response teams during testing and actual execution of recovery procedures. Support the design, development, installation, implementation and administration of backup solutions. Make recommendations to the user community and the operations group on system enhancements.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

Business Analyst

Study the computer systems current computer systems and procedures, and design information systems solutions to help the organization operate more securely, efficiently, and effectively.

Bring business and information technology (IT) together by understanding the needs and limitations of both. Support the PMO in scoping, planning, designing, building, deploying, and closing out projects. Develop methods to monitor and measure risk, compliance, and assurance efforts. Perform needs analysis to determine opportunities for new and improved business process solutions. Provide ongoing optimization and problem-solving support. Provide input to the Risk Management Framework process activities and related documentation (e.g., system

GSA MAS Contract #: GS-35F-0633P 12 life-cycle support plans, concept of operations, operational procedures, and maintenance training materials). Ensure all systems security operations and maintenance activities are properly documented and updated as necessary. Perform security reviews, identify gaps in security architecture. Plan and recommend modifications or adjustments based on exercise results or system environment. Properly document systems security implementation, operations, and maintenance activities and update as necessary. Provides cybersecurity recommendations to leadership based on significant threats and vulnerabilities. Work with stakeholders to resolve computer security incidents and vulnerability compliance.

Education and Experience:

Junior – 0-2 years’ experience with a bachelor’s degree or equivalent certifications.

Journeyman – 2-5 years’ experience with a bachelor’s degree or equivalent certifications.

GSA MAS Contract #: GS-35F-0633P 13

2.4. Pricing of Highly Adaptive Cybersecurity Services - SIN 54151HACS (Formerly SIN 132-45)

Labor Category and Level for SIN 54151HACS GSA MAS Price Program Manager $160.34 Chief Information Security Officer (CISO) $190.85 Project Manager - Level III $150.41 Project Manager - Level II $118.81 Project Manager - Level I $94.50 Cyber Security SME - Level III $171.84 Cyber Security SME - Level II $147.68 Cyber Security SME - Level I $124.43 Cyber Security Architect - Lead $149.84 Cyber Security Architect - Senior $135.49 Cyber Security Architect - Journeyman $118.04 Cyber Security Architect - Junior $104.38 Cyber Security Software Developer - Lead $147.77 Cyber Security Software Developer - Senior $135.11 Cyber Security Software Developer - Journeyman $110.92 Cyber Security Software Developer - Junior $96.45 Cyber Security Test Engineer - Lead $114.38 Cyber Security Test Engineer - Senior $105.29 Cyber Security Test Engineer - Journeyman $94.50 Cyber Security Test Engineer - Junior $77.36 Cyber Threat Analyst - Lead $143.52 Cyber Threat Analyst - Senior $120.95 Cyber Threat Analyst - Journeyman $103.04 Cyber Threat Analyst - Junior $77.34 Security Analyst - Lead $131.19 Security Analyst - Senior $113.33 Security Analyst - Journeyman $94.03 Security Analyst - Junior $75.20 Security Awareness Training Specialist - Lead $118.96 Security Awareness Training Specialist - Senior $98.45 Security Awareness Training Specialist - Journeyman $83.44 Security Awareness Training Specialist - Junior $75.20 Cyber Security and Information Security Engineer - Lead $127.83 Cyber Security and Information Security Engineer - Senior $106.31 Cyber Security and Information Security Engineer - Journeyman $88.95 Cyber Security and Information Security Engineer - Junior $74.68 Cyber Security Systems Analyst - Lead $181.14

GSA MAS Contract #: GS-35F-0633P 14

Cyber Security Systems Analyst - Senior $154.76 Cyber Security Systems Analyst - Journeyman $112.28 Cyber Security Systems Analyst - Junior $91.60 Information Systems Security Officer - Lead $131.61 Information Systems Security Officer - Senior $103.87 Information Systems Security Officer - Journeyman $87.47 Information Systems Security Officer - Junior $70.58 Network Security Administrator - Lead $118.53 Network Security Administrator - Senior $106.65 Network Security Administrator - Journeyman $94.88 Network Security Administrator - Junior $77.70 Disaster Recovery Analyst - Lead $129.08 Disaster Recovery Analyst - Senior $108.31 Disaster Recovery Analyst - Journeyman $97.27 Disaster Recovery Analyst - Junior $84.68

GSA MAS Contract #: GS-35F-0633P 15

2.5. Terms and Conditions Applicable to Highly Adaptive Cybersecurity Services (HACS) Special Item Number 54151HACS

Vendor suitability for offering services through the Highly Adaptive Cybersecurity Services (HACS) SIN must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

• Federal Acquisition Regulation (FAR) Part 52.204-21

• OMB Memorandum M-06-19 - Reporting Incidents Involving Personally Identifiable

Information and Incorporating the Cost for Security in Agency Information Technology Investments

• OMB Memorandum M -07-16 - Safeguarding Against and Responding to the Breach of Personally Identifiable Information

• OMB Memorandum M-16-03 - Fiscal Year 2015-2016 Guidance on Federal Information Security and Privacy Management Requirements

• OMB Memorandum M-16-04 – Cybersecurity Implementation Plan (CSIP) for Federal Civilian Government

• The Cybersecurity National Action Plan (CNAP)

• NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information

Technology Systems

• NIST SP 800-27A - Engineering Principles for Information Technology Security (A

Baseline for Achieving Security)

• NIST SP 800-30 - Guide for Conducting Risk Assessments

• NIST SP 800-35 - Guide to Information Technology Security Services

• NIST SP 800-37 - Guide for Applying the Risk Management Framework to Federal

Information Systems: A Security Life Cycle Approach

• NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and

Information System View

• NIST SP 800-44 - Guidelines on Securing Public Web Servers

• NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

• NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and

Organizations

• NIST SP 800-61 - Computer Security Incident Handling Guide

• NIST SP 800-64 - Security Considerations in the System Development Life Cycle

• NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

• NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

• NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment

• NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information

Systems

• NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations

GSA MAS Contract #: GS-35F-0633P 16

• NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

• NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal

Information Systems and Organizations ****NOTE: All non-professional labor categories must be incidental to, and used solely to support Highly Adaptive Cybersecurity Services, and cannot be purchased separately.

****NOTE: All labor categories under the Special Item Number 54151S Information Technology Professional Services may remain under SIN 54151S unless the labor categories are specific to the Highly Adaptive Cybersecurity Services SINs.

2.5.1. Scope

a. The labor categories, prices, terms and conditions stated under Special Item Numbers 54151HACS High Adaptive Cybersecurity Services apply exclusively to High Adaptive Cybersecurity Services within the scope of this Information Technology Schedule.

b. Services under these SINs are limited to Highly Adaptive Cybersecurity Services only.

c. These SINs provide ordering activities with access to Highly Adaptive Cybersecurity services only.

d. Highly Adaptive Cybersecurity Services provided under these SINs shall comply with all Cybersecurity certifications and industry standards as applicable pertaining to the type of services as specified by ordering agency.

e. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2.5.2. Order

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket Purchase Agreements, individual purchase orders, or task orders for ordering services under this contract.

Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

2.5.3. Performance Of Services

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity. All Contracts will be fully funded.

b. The Contractor agrees to render services during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

GSA MAS Contract #: GS-35F-0633P 17

d. Any Contractor travel required in the performance of Highly Adaptive Cybersecurity Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts. All travel will be agreed upon with the client prior to the Contractor’s travel.

2.5.4. Inspection Of Services

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND

CONDITIONS – COMMERCIAL ITEMS (MAY 2015) (ALTERNATE II – JUL 2009) (FAR

DEVIATION – JUL 2015) (TAILORED) for Firm-Fixed Price and Time-and-Materials and Labor-Hour Contracts orders placed under this contract.

2.5.5. Responsibilities Of The Contractor

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (MAY 2014) Rights in Data – General, may apply.

The Contractor shall comply with contract clause (52.204-21) to the Federal Acquisition Regulation (FAR) for the basic safeguarding of contractor information systems that process, store, or transmit Federal data received by the contract in performance of the contract. This includes contract documents and all information generated in the performance of the contract.

2.5.6. Responsibilities Of The Ordering Activity

Subject to the ordering activity’s security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Highly Adaptive Cybersecurity Services.

2.5.7. Independent Contractor

All Highly Adaptive Cybersecurity Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

2.5.8. Organizational Conflicts Of Interest

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either

(i) result in an unfair competitive advantage to the Contractor or its affiliates or

(ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

GSA MAS Contract #: GS-35F-0633P 18

b) To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract.

Examples of situations, which may require restrictions, are provided at FAR 9.508.

2.5.9. Invoices

The Contractor, upon completion of the work ordered, shall submit invoices for Highly Adaptive Cybersecurity Services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

2.5.10. Resumes

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

2.5.11. Approval Of Subcontracts

The ordering activity may require that the Contractor receive, from the ordering activity's Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

2.5.12. Description Of Highly Adaptive Cybersecurity Services And Pricing

a. The Contractor shall provide a description of each type of Highly Adaptive Cybersecurity Service offered under Special Item Number 132-45 for Highly Adaptive Cybersecurity Services and it should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided. (See Section 2.3)

b. Pricing for all Highly Adaptive Cybersecurity Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates,, minimum general experience and minimum education. The following is an example of the manner in which the description of a commercial job title should be presented (see SCP FSS 004)

GSA MAS Contract #: GS-35F-0633P 19

3.0 DESCRIPTIONS OF INFORMATION TECHNOLOGY

PROFESSIONAL SERVICES - SIN 54151S (FORMERLY SIN

132-51)

3.1. Labor Category Descriptions

Labor Category:

Program Manager

General Experience:

Seven years of technical experience, at least five years of management experience

Functional Description:

Responsible for overall program management of complex, multi-task IT contracts. Oversees all technical operations, prepares financial and budget reports, and tracks financial and contractual requirements. Responsible for cost and quality control. Works with client representatives to ensure smooth contract operation. Manages technical and administrative personnel. Works independently without direct supervision.

Minimum Education:

BA/BS in related Business or relevant field; MA/MS in related field or MBA is highly preferred.

Program Manager II

General Experience:

Ten years of technical experience, at least seven years of management experience

Functional Description:

Responsible for overall program management of complex, multi-task IT contracts. Oversees all technical operations, prepares financial and budget reports, and tracks financial and contractual requirements. Responsible for cost and quality control. Works with client representatives to ensure smooth contract operation. Manages technical and administrative personnel. Works independently without direct supervision.

Minimum Education:

Project Manager

General Experience:

Minimum four years of related technical experience. Minimum one year of supervisory experience

Functional Description:

Manages small projects or single tasks on large, complex projects. Directs completion of tasks within estimated timeframes and budget constraints. Schedules and assigns duties to subordinates and subcontractors and ensures assignments are competed as directed. Ensures compliance with contract requirements. May be a senior technical expert who provides advice, design, and development on complex technical tasks. Works independently without direct supervision.

Minimum Education:

BA/BS in Business or related field.

Project Manager II

General Experience:

Minimum of 5 years project management experience overseeing development projects using various Software Development Lifecycle methodologies. At least 8 years of combined IT experience that includes business and system requirements definition, system design, system development and/or system testing.

Functional Description:

Manages small projects or single tasks on large, complex projects. Schedules and assigns duties to subordinates and subcontractors and ensures assignments are competed as directed. Ensures compliance with contract requirements. May be a senior technical expert who provides advice, design, and development on complex technical tasks. Leads software projects on a variety of

GSA MAS Contract #: GS-35F-0633P 20 software platforms. Skills should include cost and budget management, risk management, resource management and very strong customer interfacing abilities. Must be strong at creating and verifying software project documentation including systems requirements, systems designs, test plans, and project reviews. Works independently without direct supervision. Must possess strong written and oral communication skills to ensure effective interaction with customers and project team members.

Minimum

BA/BS in Business or related field.

Principal Information Engineer

General Experience:

Seven years of technical experience

Functional…