MAS - Attainx Inc. - GS35F293DA

GENERAL SERVICES ADMINISTRATION

Federal Acquisition Service Authorized Federal Supply Schedule FSS Price List

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order is available through GSA Advantage!™, a menu-driven database system.

The INTERNET address for GSA Advantage!™ is: GSAAdvantage.gov.

Multiple Award Schedule (MAS) Federal Supply Group: Professional Services Class: D399

Contract Number: GS-35F-293DA For more information on ordering go to the following website: https://www.gsa.gov/schedules.

Contract Period: Apr 29, 2016 - Apr 28, 2026 Price List current as of Modification #PS-0020, effective 02/01/2024

Contractor: Attainx, Inc.

13873 Park Center Road Suite 55N Herndon VA 20171

Business Size: 8(a) Woman Owned Small Business (WOSB)/ EDWOSB

Telephone: 202-400-2259 Extension: N/A FAX Number: 703-890-2357 Web Site: www.attainx.com E-mail: operations@attainx.com Contract Administration: Sheryll Manoj

CUSTOMER INFORMATION:

1a. Table of Awarded Special Item Number(s) with appropriate cross-reference to item descriptions and awarded price(s):

SIN

54151S INFORMATION TECHNOLOGY (IT) PROFESSIONAL SERVICES

54151HEAL HEALTH IT SERVICES

54151HACS HIGHLY ADAPTIVE CYBERSECURITY SERVICES (HACS)

541611 MANAGEMENT AND FINANCIAL CONSULTING, ACQUISITION AND GRANTS

MANAGEMENT SUPPORT, AND BUSINESS PROGRAM AND PROJECT

MANAGEMENT SERVICES

541620 ENVIRONMENTAL CONSULTING SERVICES

518210C CLOUD AND CLOUD-RELATED IT PROFESSIONAL SERVICES

OLM ORDER-LEVEL MATERIALS (OLMS)

1b. Identification of the lowest priced model number and lowest unit price for that model for each special item number awarded in the contract. This price is the Government price based on a unit of one, exclusive of any quantity/dollar volume, prompt payment, or any other concession affecting price. Those contracts that have unit prices based on the geographic location of the https://www.gsa.gov/schedules customer, should show the range of the lowest price, and cite the areas to which the prices apply. Reference Page 3 & 4

1c. If the Contractor is proposing hourly rates a description of all corresponding commercial job titles, experience, functional responsibility and education for those types of employees or subcontractors who will perform services shall be provided. If hourly rates are not applicable, indicate “Not applicable” for this item. Reference Page 17 - 31

2. Maximum Order: $1,000,000

3. Minimum Order: $100

4. Geographic Coverage (delivery Area): SIN 54151HEAL - World Wide, 518210C – World Wide, and

SINs 54151HACS, 54151S, 541611, 541620, and OLM - Domestic

5. Point(s) of production (city, county, and state or foreign country): N/A

6. Discount from list prices or statement of net price: Government net prices (discounts already deducted).

7. Quantity discounts: None

8. Prompt payment terms: 0% Net 30; Information for Ordering Offices: Prompt payment terms cannot be negotiated out of the contractual agreement in exchange for other concessions

9. Foreign items (list items by country of origin): None

10a. Time of Delivery (Contractor insert number of days): Specified on the Task Order

10b. Expedited Delivery. Items available for expedited delivery are noted in this price list

10c. Overnight and 2-day delivery. Overnight and 2-day delivery are available. Contact the Contractor for rates.

10d. Urgent Requirements. Agencies can contact the Contractor’s representative to affect a faster delivery.

Customers are encouraged to contact the contractor for the purpose of requesting accelerated delivery.

11. F.O.B Points(s): Destination

12a. Ordering Address(es): Same as Contractor

12b. Ordering procedures: See Federal Acquisition Regulation (FAR) 8.405-3

13. Payment address(es): Same as company address

14. Warranty provision.: Contractor’s standard commercial warranty.

15. Export Packing Charges (if applicable): N/A

16. Terms and conditions of rental, maintenance, and repair (if applicable): N/A

17. Terms and conditions of installation (if applicable): N/A

18a. Terms and conditions of repair parts indicating date of parts price lists and any discounts from list prices (if applicable): N/A

18b. Terms and conditions for any other services (if applicable): N/A

19. List of service and distribution points (if applicable): N/A

20. List of participating dealers (if applicable): N/A

21. Preventive maintenance (if applicable): N/A

22a. Special attributes such as environmental attributes (e.g., recycled content, energy efficiency, and/or reduced pollutants): N/A

22b. If applicable, indicate that Section 508 compliance information is available on Electronic and

Information Technology (EIT) supplies and services and show where full details can be found (e.g. contactor’s website or other location.) The EIT standards can be found at:

www.Section508.gov/: N/A

23. Unique Entity Identifier (UEI) number. J6Z9VBSL4219

24. Notification regarding registration in System for Award Management (SAM) database: Contractor registered and active in SAM

Final Pricing:

The rates shown below include the Industrial Funding Fee (IFF) of 0.75%.

Pricing Proposed Labor Category APPROVED GSA PRICING

54151S IT Professional Services Business and Systems Analyst $112.39 IT Security Specialist $107.51 IT Support / Helpdesk Specialist $ 52.78 Project Manager $127.05 QA Specialist $ 78.19 Senior Consultant $290.18 Software and Database Developer $112.39 Systems, Network and Database Administrator $102.62 Technical Project Manager $135.17 Software and Database Developer – Senior $146.73 Software and Database Developer – Mid $127.27 Configuration Management Specialist $102.93 Test Engineer $105.29

54151HEALTH Health IT Health IT Business and Systems Analyst $112.39 Health IT Security Specialist $107.51 Health IT Support / Helpdesk Specialist $ 52.78 Health IT Project Manager $127.05 Health IT QA Specialist $ 78.19 Health IT Senior Consultant $290.18 Health IT Software and Database Developer $112.39 Health IT Systems, Network and Database Administrator $102.62 http://www.section508.gov/

54151HACS HACS SIN

Penetration Testing $107.51 Incident Response Analyst $112.39 Forensics Analyst $136.83 Cyber Program/Project Manager $127.05 Cyber Security Engineer $144.64 Vulnerability Security Analyst $102.62

541611 MANAGEMENT AND FINANCIAL CONSULTING, ACQUISITION AND GRANTS

MANAGEMENT SUPPORT, AND BUSINESS PROGRAM AND PROJECT MANAGEMENT SERVICES

Administrative Support** $64.18 System Analyst $110.59 Engineer $148.65 Program and Project Manager $128.36 Subject Matter Expert $222.29 Training Specialist $162.92 Test Engineer $109.26

541620 ENVIORNMENTAL CONSULTING SIN

Environmental Reviewer $202.91 Program and Project Manager $128.36

518210 CLOUD AND CLOUD-RELATED IT PROFESSIONAL SERVICES SIN

Cloud Data Engineer $109.93 Cloud Technology Developer (Journeyman) $74.55 Cloud Technology Developer (Senior) $99.07 Cloud Technology Developer (Master) $135.15 Cloud Security Engineer $110.47 Cloud Solutions Architect $166.15

Service Contract Labor Standards/Service Contract Act (SCLS/SCA) Matrix

SCA Eligible Labor Category SCA Equivalent Code Title Wage Determination No Administrative Support Accounting Clerk II - 01012 2015-4281

The Service Contract Labor Standards, formerly the Service Contract Act (SCA), apply to this contract and it includes SCLS applicable labor categories.

Labor categories and fixed price services marked with a (**) in this pricelist are based on the U.S. Department of Labor Wage Determination Number(s) identified in the SCLS/SCA matrix. The prices awarded are in line with the geographic scope of the contract (i.e., nationwide).

1. SCOPE

a. The prices, terms and conditions stated under Special Item Number 54151S Information Technology Professional Services and 54151HEALTH Health IT apply exclusively to IT Services within the scope of this Information Technology Schedule.

b. The Contractor shall provide services at the Contractor's facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2. PERFORMANCE INCENTIVES I-FSS-60 Performance Incentives (April 2000)

a. Performance incentives may be agreed upon between the Contractor and the ordering activity on individual fixed price orders or Blanket Purchase Agreements under this contract in accordance with this clause.

b. The ordering activity must establish a maximum performance incentive price for these services and/or total solutions on individual orders or Blanket Purchase Agreements.

c. Incentives should be designed to relate results achieved by the contractor to specified targets. To the maximum extent practicable, ordering activities shall consider establishing incentives where performance is critical to the ordering activity's mission and incentives are likely to motivate the contractor.

Incentives shall be based on objectively measurable tasks.

3. ORDER

a. Agencies may use written orders, EDI orders, blanket purchase agreements, individual purchase orders, or task orders for ordering services under this contract. Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation - May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

4. PERFORMANCE OF SERVICES

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity.

b. The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

TERMS AND CONDITIONS APPLICABLE TO INFORMATION TECHNOLOGY (IT)

PROFESSIONAL SERVICES (SPECIAL ITEM NUMBER 54151S)

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of IT Services & Health IT must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed.

Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts.

5. STOP-WORK ORDER (FAR 52.242-15) (AUG 1989)

(a) The Contracting Officer may, at any time, by written order to the Contractor, require the Contractor to stop all, or any part, of the work called for by this contract for a period of 90 days after the order is delivered to the Contractor, and for any further period to which the parties may agree. The order shall be specifically identified as a stop-work order issued under this clause. Upon receipt of the order, the Contractor shall immediately comply with its terms and take all reasonable steps to minimize the incurrence of costs allocable to the work covered by the order during the period of work stoppage. Within a period of 90 days after a stop-work is delivered to the Contractor, or within any extension of that period to which the parties shall have agreed, the Contracting Officer shall either-

(1) Cancel the stop-work order; or

(2) Terminate the work covered by the order as provided in the Default, or the Termination for Convenience of the Government, clause of this contract.

(b) If a stop-work order issued under this clause is canceled or the period of the order or any extension thereof expires, the Contractor shall resume work. The Contracting Officer shall make an equitable adjustment in the delivery schedule or contract price, or both, and the contract shall be modified, in writing, accordingly, if-

(1) The stop-work order results in an increase in the time required for, or in the Contractor's cost properly allocable to, the performance of any part of this contract; and

(2) The Contractor asserts its right to the adjustment within 30 days after the end of the period of work stoppage; provided, that, if the Contracting Officer decides the facts justify the action, the Contracting Officer may receive and act upon the claim submitted at any time before final payment under this contract.

(c) If a stop-work order is not canceled and the work covered by the order is terminated for the convenience of the Government, the Contracting Officer shall allow reasonable costs resulting from the stop-work order in arriving at the termination settlement.

(d) If a stop-work order is not canceled and the work covered by the order is terminated for default, the Contracting Officer shall allow, by equitable adjustment or otherwise, reasonable costs resulting from the stop-work order.

6. INSPECTION OF SERVICES

The Inspection of Services-Fixed Price (AUG 1996) (Deviation - May 2003) clause at FAR 52.246-4 applies to firm-fixed price orders placed under this contract. The Inspection-Time-and-Materials and Labor-Hour (JAN 1986) (Deviation - May 2003) clause at FAR 52.246-6 applies to time-and-materials and labor-hour orders placed under this contract.

7. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (Deviation - May 2003) Rights in Data - General, may apply.

8. RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite IT Services.

9. INDEPENDENT CONTRACTOR

All IT Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

10. ORGANIZATIONAL CONFLICTS OF INTEREST

a. Definitions.

"Contractor" means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

"Contractor and its affiliates" and "Contractor or its affiliates" refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An "Organizational conflict of interest" exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either (i) result in an unfair competitive advantage to the Contractor or its affiliates or (ii) impair the Contractor's or its affiliates' objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts.

Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at

FAR

9.508.

11. INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for IT services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

12. PAYMENTS

For firm-fixed price orders the ordering activity shall pay the Contractor, upon submission of proper invoices or vouchers, the prices stipulated in this contract for service rendered and accepted.

Progress payments shall be made only when authorized by the order. For time-and-materials orders, the Payments under Time-and-Materials and Labor-Hour Contracts at FAR 52.232-7 (DEC 2002), (Alternate II - Feb 2002) (Deviation - May 2003) applies to time-and-materials orders placed under this contract. For labor-hour orders, the Payment under Time-and-Materials and Labor-Hour Contracts at FAR 52.232-7 (DEC 2002), (Alternate II - Feb 2002) (Deviation - May 2003)) applies to labor-hour orders placed under this contract.

13. RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

14. INCIDENTAL SUPPORT COSTS

Incidental support costs are available outside the scope of this contract. The costs will be negotiated separately with the ordering activity in accordance with the guidelines set forth in the

FAR.

15. APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity's Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

16. DESCRIPTION OF IT SERVICES AND PRICING

a. The Contractor shall provide a description of each type of IT Service offered under Special Item Numbers 54151S IT Services should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

b. Pricing for all IT Services shall be in accordance with the Contractor's customary commercial practices; e.g., hourly rates, monthly rates, term rates, and/or fixed prices.

The following is an example of the manner in which the description of a commercial job title should be presented:

EXAMPLE: Commercial Job Title: System Engineer

Minimum/General Experience: Three (3) years of technical experience which applies to systems analysis and design techniques for complex computer systems. Requires competence in all phases of systems analysis techniques, concepts and methods; also requires knowledge of available hardware, system software, input/output devices, structure and management practices.

Functional Responsibility: Guides users in formulating requirements, advises alternative approaches, conducts feasibility studies.

Minimum Education: Bachelor's Degree in Computer Science

TERMS AND CONDITIONS APPLICABLE TO

HEALTH INFORMATION TECHNOLOGY (IT) SERVICES

(SPECIAL ITEM NUMBER 54151HEALTH)

Vendor suitability for offering services through the new Health IT SIN must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

1. Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH)

2. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

3. National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) and Special Publications

4. Federal Information Security Management Act (FISMA) of 2002

****NOTE: All non-professional labor categories must be incidental to, and used solely to support Health IT services, and cannot be purchased separately.

Vendor suitability for offering services through the new Health IT SIN must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

• Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH)

• The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

• National Institute of Standards and Technology (NIST) Federal Information Processing

Standards (FIPS) and Special Publications

• Federal Information Security Management Act (FISMA) of 2002

1. SCOPE

a. The labor categories, prices, terms and conditions stated under Special Item Number 54151HEALTH

Health Information Technology Services apply exclusively to Health IT Services within the scope of this Information Technology Schedule.

b. This SIN is limited to Health IT Services only. Software and hardware products are out of scope.

Hardware and software can be acquired through different Special Item Numbers on MAS.

c. This SIN provides ordering activities with access to Health IT services.

d. Health IT Services provided under this SIN shall comply with all Healthcare certifications and industry standards as applicable at the task order level.

e. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2. ORDER

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket Purchase

Agreements, individual purchase orders, or task orders for ordering services under this contract.

Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

3. PERFORMANCE OF SERVICES

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity. All Contracts will be fully funded.

b. The Contractor agrees to render services only during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of Health IT Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts. All travel will be agreed upon with the client prior to the Contractor’s travel.

4. INSPECTION OF SERVICES

In accordance with FAR 52.212-4 CONTRACT TERMS AND CONDITIONS--COMMERCIAL ITEMS (MAR 2009) (DEVIATION I - FEB 2007) for Firm-Fixed Price orders and FAR 52.212-4 CONTRACT

TERMS AND CONDITIONS −COMMERCIAL ITEMS (MAR 2009) (ALTERNATE I − OCT 2008)

(DEVIATION I – FEB 2007) applies to Time-and-Materials and Labor-Hour Contracts orders placed under this contract.

5. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (Dec 2007) Rights in Data – General, may apply.

6. RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Health IT Services.

7. INDEPENDENT CONTRACTOR

All Health IT Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

8. ORGANIZATIONAL CONFLICTS OF INTEREST

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either

(i) result in an unfair competitive advantage to the Contractor or its affiliates or

(ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b. To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

9. INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for Health IT Professional services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

10. RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

11. INCIDENTAL SUPPORT COSTS

Incidental support costs are not considered part of the scope of this contract. The costs will be negotiated separately with the ordering activity in accordance with the guidelines set forth in the FAR.

12. APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity's Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

13. DESCRIPTION OF HEALTH IT SERVICES AND PRICING

a. The Contractor shall provide a description of each type of Health IT Service offered under Special Item

Numbers 54151HEALTH Health IT Services and it should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

b. Pricing for all Health IT Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates, monthly rates, term rates, and/or fixed prices, minimum general experience and minimum education.

Vendor suitability for offering services through the Highly Adaptive Cybersecurity Services (HACS) SINs must be in accordance with the following laws and standards when applicable to the specific task orders, including but not limited to:

● Federal Acquisition Regulation (FAR) Part 52.204-21

● OMB Memorandum M-06-19 - Reporting Incidents Involving Personally Identifiable Information and

Incorporating the Cost for Security in Agency Information Technology Investments

● OMB Memorandum M -07-16 - Safeguarding Against and Responding to the Breach of Personally

Identifiable Information

● OMB Memorandum M-16-03 - Fiscal Year 2015-2016 Guidance on Federal Information Security and

Privacy Management Requirements

● OMB Memorandum M-16-04 – Cybersecurity Implementation Plan (CSIP) for Federal Civilian

Government

● The Cybersecurity National Action Plan (CNAP)

● NIST SP 800-14 - Generally Accepted Principles and Practices for Securing Information Technology Systems

● NIST SP 800-27A - Engineering Principles for Information Technology Security (A Baseline for Achieving Security)

● NIST SP 800-30 - Guide for Conducting Risk Assessments

● NIST SP 800-35 - Guide to Information Technology Security Services

● NIST SP 800-37 - Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach

● NIST SP 800-39 - Managing Information Security Risk: Organization, Mission, and Information System View

● NIST SP 800-44 - Guidelines on Securing Public Web Servers

● NIST SP 800-48 - Guide to Securing Legacy IEEE 802.11 Wireless Networks

● NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

● NIST SP 800-61 - Computer Security Incident Handling Guide

● NIST SP 800-64 - Security Considerations in the System Development Life Cycle

● NIST SP 800-82 - Guide to Industrial Control Systems (ICS) Security

● NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response

● NIST SP 800-115 - Technical Guide to Information Security Testing and Assessment

● NIST SP 800-128 - Guide for Security-Focused Configuration Management of Information Systems

● NIST SP 800-137 - Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations

● NIST SP 800-153 - Guidelines for Securing Wireless Local Area Networks (WLANs)

● NIST SP 800-171 - Protecting Controlled Unclassified Information in non-federal Information Systems and Organizations

****NOTE: All non-professional labor categories must be incidental to, and used solely to support Highly Adaptive Cybersecurity Services, and cannot be purchased separately.

****NOTE: All labor categories under the Special Item Number 54151S Information Technology Professional Services may remain under SIN 54151S unless the labor categories are specific to the Highly Adaptive Cybersecurity Services SINs.

TERMS AND CONDITIONS APPLICABLE TO HIGHLY ADAPTIVE CYBERSECURITY SERVICES (HACS)

SPECIAL ITEM NUMBERS 54151HACS

1. SCOPE

a. The labor categories, prices, terms and conditions stated under Special Item 54151HACS High Adaptive Cybersecurity Services apply exclusively to High Adaptive Cybersecurity Services within the scope of this Information Technology Schedule.

b. Services under these SINs are limited to Highly Adaptive Cybersecurity Services only. Software and hardware products are under different Special Item Numbers on MAS and may be quoted along with services to provide a total solution.

c. These SINs provide ordering activities with access to Highly Adaptive Cybersecurity services only.

d. Highly Adaptive Cybersecurity Services provided under these SINs shall comply with all

Cybersecurity certifications and industry standards as applicable pertaining to the type of services as specified by ordering agency.

e. The Contractor shall provide services at the Contractor’s facility and/or at the ordering activity location, as agreed to by the Contractor and the ordering activity.

2. ORDER

a. Agencies may use written orders, Electronic Data Interchange (EDI) orders, Blanket Purchase Agreements, individual purchase orders, or task orders for ordering services under this contract.

Blanket Purchase Agreements shall not extend beyond the end of the contract period; all services and delivery shall be made and the contract terms and conditions shall continue in effect until the completion of the order. Orders for tasks which extend beyond the fiscal year for which funds are available shall include FAR 52.232-19 (Deviation – May 2003) Availability of Funds for the Next Fiscal Year. The purchase order shall specify the availability of funds and the period for which funds are available.

b. All task orders are subject to the terms and conditions of the contract. In the event of conflict between a task order and the contract, the contract will take precedence.

3. PERFORMANCE OF SERVICES

a. The Contractor shall commence performance of services on the date agreed to by the Contractor and the ordering activity. All Contracts will be fully funded.

b. The Contractor agrees to render services during normal working hours, unless otherwise agreed to by the Contractor and the ordering activity.

c. The ordering activity should include the criteria for satisfactory completion for each task in the Statement of Work or Delivery Order. Services shall be completed in a good and workmanlike manner.

d. Any Contractor travel required in the performance of Highly Adaptive Cybersecurity Services must comply with the Federal Travel Regulation or Joint Travel Regulations, as applicable, in effect on the date(s) the travel is performed. Established Federal Government per diem rates will apply to all Contractor travel. Contractors cannot use GSA city pair contracts. All travel will be agreed upon with the client prior to the Contractor’s travel.

4. INSPECTION OF SERVICES

Inspection of services is in accordance with 552.212-4 - CONTRACT TERMS AND CONDITIONS –

COMMERCIAL ITEMS (MAY 2015) (ALTERNATE II – JUL 2009) (FAR DEVIATION – JUL 2015)

(TAILORED) for Firm-Fixed Price and Time-and-Materials and Labor-Hour Contracts orders placed under this contract.

5. RESPONSIBILITIES OF THE CONTRACTOR

The Contractor shall comply with all laws, ordinances, and regulations (Federal, State, City, or otherwise) covering work of this character. If the end product of a task order is software, then FAR 52.227-14 (MAY 2014) Rights in Data – General, may apply.

The Contractor shall comply with contract clause (52.204-21) to the Federal Acquisition Regulation (FAR) for the basic safeguarding of contractor information systems that process, store, or transmit Federal data received by the contract in performance of the contract. This includes contract documents and all information generated in the performance of the contract.

6. RESPONSIBILITIES OF THE ORDERING ACTIVITY

Subject to the ordering activity’s security regulations, the ordering activity shall permit Contractor access to all facilities necessary to perform the requisite Highly Adaptive Cybersecurity Services.

7. INDEPENDENT CONTRACTOR

All Highly Adaptive Cybersecurity Services performed by the Contractor under the terms of this contract shall be as an independent Contractor, and not as an agent or employee of the ordering activity.

8. ORGANIZATIONAL CONFLICTS OF INTEREST

a. Definitions.

“Contractor” means the person, firm, unincorporated association, joint venture, partnership, or corporation that is a party to this contract.

“Contractor and its affiliates” and “Contractor or its affiliates” refers to the Contractor, its chief executives, directors, officers, subsidiaries, affiliates, subcontractors at any tier, and consultants and any joint venture involving the Contractor, any entity into or with which the Contractor subsequently merges or affiliates, or any other successor or assignee of the Contractor.

An “Organizational conflict of interest” exists when the nature of the work to be performed under a proposed ordering activity contract, without some restriction on ordering activities by the Contractor and its affiliates, may either

(i) result in an unfair competitive advantage to the Contractor or its affiliates or

(ii) impair the Contractor’s or its affiliates’ objectivity in performing contract work.

b) To avoid an organizational or financial conflict of interest and to avoid prejudicing the best interests of the ordering activity, ordering activities may place restrictions on the Contractors, its affiliates, chief executives, directors, subsidiaries and subcontractors at any tier when placing orders against schedule contracts. Such restrictions shall be consistent with FAR 9.505 and shall be designed to avoid, neutralize, or mitigate organizational conflicts of interest that might otherwise exist in situations related to individual orders placed against the schedule contract. Examples of situations, which may require restrictions, are provided at FAR 9.508.

9. INVOICES

The Contractor, upon completion of the work ordered, shall submit invoices for Highly Adaptive

Cybersecurity Services. Progress payments may be authorized by the ordering activity on individual orders if appropriate. Progress payments shall be based upon completion of defined milestones or interim products. Invoices shall be submitted monthly for recurring services performed during the preceding month.

10. RESUMES

Resumes shall be provided to the GSA Contracting Officer or the user ordering activity upon request.

11. APPROVAL OF SUBCONTRACTS

The ordering activity may require that the Contractor receive, from the ordering activity's Contracting Officer, written consent before placing any subcontract for furnishing any of the work called for in a task order.

12. DESCRIPTION OF HIGHLY ADAPTIVE CYBERSECURITY SERVICES AND PRICING

a. The Contractor shall provide a description of each type of Highly Adaptive Cybersecurity Service offered under Special Item Number 54151HACS for Highly Adaptive Cybersecurity Services and it should be presented in the same manner as the Contractor sells to its commercial and other ordering activity customers. If the Contractor is proposing hourly rates, a description of all corresponding commercial job titles (labor categories) for those individuals who will perform the service should be provided.

b. Pricing for all Highly Adaptive Cybersecurity Services shall be in accordance with the Contractor’s customary commercial practices; e.g., hourly rates,, minimum general experience and minimum education. The following is an example of the manner in which the description of a commercial job title should be presented (see SCP FSS 004)

EXAMPLE

Commercial Job Title: Computer Network Defense Analysis Description: Uses defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or might occur within the network in order to protect information, information systems, and networks from threats.

Professionals involved in this specialty perform the following tasks:

• Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities

• Provide daily summary reports of network events and activity relevant to Computer Network Defense practices

• Monitor external data sources (e.g., Computer Network Defense vendor sites, Computer Emergency Response Teams, SANS, Security Focus) to maintain currency of Computer Network Defense threat condition and determine which security issues may have an impact on the enterprise.

Knowledge, Skills and Abilities: Knowledge of applicable laws (e.g., Electronic Communications Privacy Act, Foreign Intelligence Surveillance Act, Protect America Act, search and seizure laws, civil liberties and privacy laws, etc.), statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures relevant to work performed

Minimum Experience: 5 Years

Minimum Education Requirements: a bachelor's of science degree with a concentration in computer science, cybersecurity services, management information systems (MIS), engineering or information science is essential.

Highly Desirable: Offensive Security Certified Professional (OSCP) or commercial Cybersecurity advanced certification(s).

SIN 54151S Labor Category Descriptions

For all of the below labor categories listed below, AttainX will accept:

• 2 year of work experience in lieu of High School Diploma

• 4 year of work experience in lieu of a Bachelor’s Degree

• 6 year of work experience in lieu of Master Degree

1. Business and Systems Analyst

Minimum/General Experience: At least three years of related hands-on experience with the specific application, domain, software or other requirements specified by an actual Statement of Work or Statement of Need.

Functional Responsibility: Provide business and functional knowledge in a specific domain or software with general knowledge of other domains. Provides strategic guidance and influences program direction.

Recommends large scale information system solutions, and assists with business integration across organizational levels. Provides program-level guidance within area of expertise and recommends domain-specific solutions and policies. Evaluates various business models including cost-benefit analysis and return on investment (ROI).

Minimum Education: : A Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related discipline.

2. IT Security Specialist Minimum/General Experience: At least three years of experience in IT infrastructure, information security technology, policy and procedure development.

Functional Responsibility: Analyzes and defines complex information security, automated information security (AIS), and/or computer security requirements. Designs, develops, engineers, and implements security solutions. Gathers and organizes technical information about an organization’s mission, goals, and needs; existing security products; and ongoing programs. Develops, analyzes, and implements security architecture(s) as appropriate. Performs risk analysis and security audit services, develops analytical reports as required. May be required to perform in one or more of the following areas: AIS risk assessment methods and procedures; security of system software generation; security of computer hardware; operating system utility/support software; disaster recovery and contingency planning; telecommunications security;

development of AIS security policies and procedures.

Minimum Education: A Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or other related scientific or technical discipline.

3. IT Support/ Helpdesk Specialist equipment, software or other requirements specified by an actual Statement of Work or Statement of Need

Functional Responsibility: Provides remote support to users for network and desktop hardware and software problems. Takes calls from users, diagnoses problems, recommends and/or implements solutions, and provides follow-up. Has experience and understanding of MIS environment. Typically involves use of problem management database and help desk systems.

Minimum Education: High School Diploma or equivalent experience and training

4. Project Manager Minimum/General Experience: At least five year experience with three year experience as a Project Manager.

Functional Responsibility: Manages multiple IT projects or single project involving Application development, IT infrastructure support, Datacenter support, Network support and emerging technologies such as cloud computing, virtualization, VDI and more. Manage people and processes to support the tasks required. Responsible for project plan, schedule, deliverables, risk management and staffing. Ensures quality of deliverables. Interact with customer to gather requirements and act as liaison between project team and customer. Organizes, directs, and coordinates planning and production of all project activities.

Responsible for formulating and enforcing work standards, assigning contractor schedules, reviewing work discrepancies, supervising contractor personnel, and communicating policies, purposes, and goals of the organization to subordinate personnel. Responsible for overall project performance.

Business or other related scientific or technical discipline

5. Quality Assurance Specialist Minimum/General Experience: At least three years in QA areas such as configuration management, verification and validation, software testing and integration, software metrics and software quality assessment.

Functional Responsibility: Develops, implements, and maintains quality assurance/configuration management programs in support of a variety of software, hardware, and services. Establish standards for life cycle, documentation, development methods, testing, and maintenance. Develops and defines major and minor characteristics of quality/configuration management (including metrics and scoring parameters) and determines requisite quality control/configuration management resources for an actual task order.

Perform all testing functions including creating test cases, test plans, system testing, regression testing, performance testing and support UAT. Conducts or participates in formal and informal reviews at predetermined points throughout the system life cycle. Serve as liaison between Project Management and other functional groups to resolve issues regarding quality /configuration management. Reviews and evaluates software products and services for adherence to government directives, standards, and guidelines. May provide task direction and guidance to less experienced team members

Minimum Education: A Bachelor’s degree in Computer Science, Information Systems, and Engineering, Business or other related scientific or technical discipline.

6. Senior Consultant Minimum/General Experience: Eight years of experience and possesses unique experience, skills, and expert knowledge in highly specialized technical, functional, and/or process areas across technical/ engineering disciplines.

Functional Responsibilities: Provides leadership and guidance for engineering of systems, system elements, interfacing systems, components, cloud-based technologies, devices and/or processes. Applies best industry practices and standards, leading-edge technology, and innovative solutions to intractable problems. Works directly with customer management to apply advanced principles, theories, and concepts and develops comprehensive solutions to complex problems. Defines key concepts for planning, deployment, integration, operation and/or enhancement of state-of-the-art and/or legacy systems. Employs methodologies for guiding others in problem resolution. Develops insightful solutions to meet fiscal, technological and schedule constraints.

Minimum Education: A Bachelor’s degree from an accredited college or university in education, training or related field of study.

7. Software and Database Developer Minimum/General Experience: At least three years of experience in developing Software or Database programming.

Functional Responsibility: Develop software and database specifications and requirements. Contribute to the definition, analysis, design, development and testing of software. Support application programming involving database access including SQLServer, Oracle, etc or knowledge or real-time application development. Supervise and provide technical leadership and mentoring in a number of software development techniques and skills. Interface with customers to identify software and database requirements.

8. Systems, Network and Database Administrator Minimum/General Experience: At least three years of experience in IT system, network and/or database administration, configuration, architecture, design and maintenance.

Functional Responsibility: Installs, maintains, and coordinates the customer’s systems, servers, storage, databases, cloud computing technologies and network. Evaluate hardware and software, including peripheral, output, and telecommunications equipment. Install, configure and maintain operating systems like Windows, Linux, UNIX, mainframe, Storage Area Network (SAN), databases and network devices.

Install, configure and maintain network equipment’s including CISCO, Nortel and Big 5. Enforces security procedures, installs network, database, software, and manages performance. Troubleshoots and resolves problems. Implements and coordinates policies, procedures, and standards.

9. Technical Project Manager Minimum/General Experience: At least Five years in project/ portfolio management of multiple software development or IT infrastructure related projects.

Functional Responsibility: Manages mid-size and small programs involving multiple projects in software development, IT modernization, cloud computing, Infrastructure support or other IT services. Organizes, directs and coordinates planning and production of all contract support activities. Act as liaison with client PMO in understanding IT requirements and developing project plans to execute the project. Demonstrate communications skills at all levels of management. Responsible for formulating and enforcing work standards, assigning schedules, reviewing work discrepancies, supervising contractor personnel, and communicating policies, purposes, and goals of the organization to subordinate personnel. Responsible for overall contract performance. Under stringent time frames, assembles and recruits as necessary to perform assigned tasks.

Business or other related scientific or technical discipline.

10. Software and Database Developer - Senior Minimum/General Experience: At least Eight years of experience in developing Software or Database programming.

Functional Responsibility: Develop software and database specifications and requirements. Contribute to the definition, analysis, design, development and testing of software. Support application programming involving technologies such as .NET, Java, J2EE, SQLServer, Oracle, etc or knowledge or real-time application development. Supervise and provide technical leadership and mentoring in a number of software development techniques and skills. Interface with customers to identify software and database requirements.

Business, or other related scientific or technical discipline

11. Software and Database Developer - Mid Minimum/General Experience: At least Five years of experience in developing Software or Database programming.

Functional Responsibility: Develop software and database specifications and requirements. Contribute to the definition, analysis, design, development and testing of software.