MAS - Secure Technology Integration Group LTD. - GS35F304BA

Secure Technology Integration Group, Ltd.

GSA Schedule 70 GS-35F-304BA

General Services Administration

Federal Acquisition Service

Authorized Federal Supply Schedule FSS Pricelist

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order is available through GSA Advantage!, a menu-driven database system. The INTERNET address for GSA Advantage! is http://www.gsa.gsaadvantage.gov Multiple Award Schedule

FSC Group: Information Technology

CONTRACT NUMBER: GS-35F-304BA

CONTRACT PERIOD: April 2, 2024 to April 1, 2029 For more information on ordering, go to the following website: https://www.gsa.gov/schedules

Secure Technology Integration Group, Ltd.

201 Rock Road, Suite 2X Glen Rock, NJ 07452 gsa@stig.net Contract Administration Source:

Jonathan Kobrick 201-825-1255 jon@stig.net Business Size: Small Business

Pricelist Current through Modification PO-0045 dated April 2, 2024 Prices Shown Herein are Net (discount deducted)

CUSTOMER INFORMATION

1a.

Table of awarded Special Item Numbers

1b.

Lowest Priced Model Number and Price for Each SIN:

54151S: Technical Analyst $98.08

1c.

Hourly Rates:

A description of all corresponding commercial job titles, experience, functional responsibility and education for those types of employees or subcontractors who will perform services shall be provided. See page 10.

2. Maximum order:

SIN 54151S: $500,000

OLM:

$250,000

3. Minimum Order: $100.00

4. Geographic Coverage (delivery area): 48 states, Washington DC

5. Point of production: Same as company address

6. Discount from list prices or statement of net price: Government net prices (discounts already deducted).

7. Volume Discount: None

8. Prompt payment terms: Net 30 Days

9. Foreign items: None

10a. Time of delivery: As Negotiated between ordering agency and Contractor

10b.Expedited Delivery: Contact Contractor

10c. Overnight and 2-day delivery: Contact Contractor

10d. Urgent Requirements: Contact Contractor

11.

F.O.B. Points: Destination

12a. Ordering Address: Same as Contractor

12b. Ordering Procedures: For supplies and services, the ordering procedures, information on Blanket Purchase Agreements (BPA’s) are found in Federal Acquisition Regulation (FAR) 8.405-3.

13. Payment address:

PAYMENT via CHECK/U.S. Mail

ACH Payments STIGroup, Ltd.

STIGroup, Ltd.

201 Rock Road

JP Morgan Chase Bank

Suite 2X

ABA routing number: see invoice

Glen Rock, NJ 07452

Account number: see invoice

14. Warranty provision: N/A

15. Export Packing Charges: N/A

16. Terms and conditions of rental, maintenance, and repair: N/A

17. Terms and conditions of installation: N/A

18a. Terms and conditions of repair parts indicating date of parts price lists and any discounts from list prices: N/A

18b. Terms and conditions for any other services: N/A

19. List of service and distribution points: N/A

20. List of participating dealers: N/A

21. Preventive maintenance: N/A

22a. Environmental attributes, e.g., recycled content, energy efficiency, and/or reduced pollutants: N/A

22b.

Section 508 Compliance for Electronic and Information Technology (EIT): N/A

23. UEI: VMV1CF9KFL85

24. Notification regarding registration in SAM database: Registered

STIGroup Information Technology Professional Services Offered

STIGroup provides Information Technology Professional Services in four practice areas as follows:

· Information Security Consulting

· Managed Security Operations

· IT Integration

· Managed IT

Information Security Consulting STIGroup specializes in securing computer networks and the mission critical information they contain. We offer services and solutions focusing on the challenges associated with IT security, cybersecurity and IT governance.

Our proven methodology uses a systematic approach with defined services and measurable outcomes to establish appropriate Information Security goals for your business. We take a four phased approach to Information Security and provide all of these services:

Phase I - Risk Assessment and Policy Development

· Business Process Review

· Information Flow Analysis

· Information Security Threat Analysis

· Regulatory Requirements Review

· Policy Gap Analysis

· Information Classification

· Administration Policy

· Assurance Policy

· Usage Policy

· Incident Response Procedure

Phase II - Audit and Vulnerability Analysis

· Internet Penetration Test

· Server/Host Configuration & Security Audit

· Infrastructure Configuration Audit

· Regulatory Compliance Audit

· Application Audit

· Vulnerability Scanning

· Wireless Network Audit

· Policy & Procedure Audit

Phase III - Architecture, Remediation, and Certification

· Firewall Architecture and Implementation

· Intrusion Detection and Prevention Systems

· Endpoint Security Solutions

· Proactive Vulnerability Scanning Tools

· Policies, Procedures, Standards and Guidelines

· Network and System Hardening/Logging

· Virtual Private Networking - VPN

· Event Management and Logging

· Authentication and Identity Solutions

· Encryption Solutions

· Content Management Solutions

· Compliance Workshops (GLB, HIPAA, etc.)

Phase IV - Information Security Management

· Managed Security Services

· Security Staffing Solutions

· Managed Firewall Solutions

· Managed Intrusion Detection Solutions

· Managed Content Filtering Solutions

· Managed Endpoint Security Solutions

· Proactive Vulnerability Management

· Incident Response and Recovery

· Technology Forensics

· Governance and Strategic Consulting

Our service offerings include:

Security Governance, Risk and Compliance Services and Solutions

· Security program management: Devise enterprise strategy which is integrated with enterprise architecture, and consistent with national and Department-level policy and standards.

· Security policy review, development and implementation: Update and maintain enterprise security policy to keep current with policy updates and threats. Provide implementation guidance and outreach to facilitate its effective implementation.

· Security framework implementation: Implement national standard and industry management frameworks such as NIST, ITIL, ISO and COBIT to improve control, increase visibility, and increase efficiency.

· Security requirements management: Analyze, adopt and manage all security and privacy requirements applicable to the enterprise. Provide support, tools and solutions to program officials and system implementers to efficiently “build security into” systems and applications.

· Risk management: Identify threats and weaknesses which could negatively impact enterprise missions, business processes and critical infrastructures. Implement risk management methods to ensure mission and business owners have the necessary information to make informed risk management decisions. Provide security reviews and assessments of contracted / outsourced services to identify risks to the agency.

· Regulatory compliance management: Provide expert services to assess organization compliance with applicable policies, requirements, and standards such as FISMA, FISCAM, OMB circulars and memos, Privacy Act, HIPAA, SOX, and PCI-DSS. Implement technology solutions to permit efficient oversight, management and reporting over these initiatives.

· Acquisition planning and support for security: Provide security subject matter expertise through acquisition and procurement to effectively and cost-efficiently define security roles, requirements, desired outcomes and performance measures.

· Audit Liaison: Support the CIO and CISO as a liaison for all information security audits, assessments and reviews. Provide audit readiness services to proactively self-assess control adequacy. Decrease impact on program and operational personnel, improve communication, and eliminate process redundancies.

Information Assurance & Privacy Services and Solutions

· Organizational and common security control definition and implementation

· Categorization of information and systems to identify security impact level (FIPS PUB 199) or mission assurance category (DOD 8500)

· Security planning and development of effective system security plans (SSP) and System Security Authorization Agreements (SSAA)

· Interconnection analysis and development of agreements

· Risk assessment and management

· Contingency planning and testing

· Privacy Impact Assessments

· Security testing and evaluation (ST&E) per NIST SP 800-53A and DOD 8500

· Certification and Accreditation (C&A) in accordance with NIST, DIACAP, CNSS and agency-specific policy

· Security information, audit and event management

· System security support such as information systems security officer (ISSO) and information assurance security officer (IASO)

Enterprise Cyber Security Services and Solutions

· Asset Discovery: Identify, associate and manage your asset inventory.

· Data Discovery: Discover and classify/categorize data on networks and databases.

· Vulnerability Assessment and Management: Perform vulnerability assessment and management of networks, commercial and open source applications, databases, and custom software.

· Penetration Testing: Perform penetration testing to discover weaknesses and collaborate with your team to identify rapid and effective remediation.

· Security Configuration Management: Harden platforms through security configuration assessment. Identify changes and deviations which are then assessed for risk and appropriately documented.

· Database Security: Deploy and operate enterprise solutions for database security monitoring, control and auditing. Implement solutions to protect sensitive and classified data.

· Log Management: Provide solutions to automate and enhance security and event log management which comply with policies, regulations and mandates.

· Forensics and Incident Response: Assess damage and properly respond to security and privacy incidents and data breaches.

IT Audit Services

· IT audit strategy and planning: Develop strategic, annual and project-specific IT audit plans that integrate seamlessly with your organization’s overall audit approach, and address executive and congressional priorities and concerns.

· Infrastructure and application audits: Our IT audit experts have the knowledge and expertise to audit nearly any network, operating system, application or security process. Enterprise infrastructure, internet applications, wireless networks, mission systems, and cloud computing outsourced services are a few examples of systems our team has audited. We follow government and industry-recognized audit standards and practices, and oftentimes identify hybrid audit approaches to effectively audit emerging technology and outsourced services.

· FISMA: Through either outsourcing or co-sourcing arrangements, STIGroup performs IT audits for the Federal Information Security Management Act (FISMA). Our team can address all areas of FISMA spanning entity, component and system level reviews of Program, Policy, Standards, Inventory, C&A, Contingency, Incident Response, Plan of Action and Milestones, Training, and Security Configuration.

· OMB A-123 & Internal Control Assessments: Our team is well versed in OMB A-123, A-127 and A-130 policy and can assist your agency with its assessment of internal control activities. We understand commonly accepted control and control assessment frameworks such as FISCAM, and can ensure that IT controls are designed appropriately, operating effectively, and support compliance with applicable laws and regulations.

· Data mining and analysis: Our team employs Computer Assisted Audit Techniques (CAATs) to perform data analysis and data mining to identify trends and pinpoint anomalies. These services can be used to support audits or periodic monitoring of controls.

Managed Security Operations Our Managed Security Operations (“MSO”) practice provides security operations management, administration, monitoring, and response services at the network, system, database, and application layers of our client technology environments. We ensure that actionable situations are detected, reported, and mitigated as efficiently as possible utilizing a combination of open source and commercial software packages, as well as custom monitoring tools.

STIGroup receives security alerts that are analyzed, investigated, and reported based on severity. In depth security infrastructure console reviews are performed on a scheduled and as-needed basis to identify trends, capacity issues, and performance bottlenecks.

The MSO team maintains a 24 hour rotation schedule for all facets of our MSO practice. A lead technical security analyst is assigned who is responsible for ensuring all service SLAs are met and open issues are tracked, reported, and addressed effectively.

A ticketing system is used for the tracking and reporting of all Client incidents and service requests.

IT Integration STIGroup has extensive experience and a significant track record of success with the design, implementation, integration, and management of the following:

Network Infrastructure Our key value is the ability to integrate best-of-breed ‘niche’ technologies with core vendor backbone technologies to achieve corporate technology goals. Our vast experience ranges from high value services, such as network assessments, corporate relocations, and the complex network integrations that result from corporate acquisition, to the more tactical, yet often mission-critical, services such as implementation of a point-solution to supplement a business initiative, or the troubleshooting of a problem that affects your business.

Wireless Networking Our capabilities range from conventional wireless LANs (802.1a,b,g,n, ac) to the implementation of purpose built wireless security solutions. Our talent and experience allow us to address the most difficult wireless design and integration tasks, such as wireless implementations under challenging environmental conditions, or complex integration of wireless networks with authentication and encryption systems.

Server Infrastructure

From Network Operating System (NOS) strategies, implementations, and integrations encompassing technologies like Microsoft Active Directory and OpenLDAP, to operating system specific challenges with Microsoft Windows and Redhat Linux. STIGroup leverages its technical expertise to accomplish complex technology integrations for our customers.

Our abilities with server infrastructure and systems include application specific technologies including messaging services, web-based services, authentication, and encryption. Our core value is the ability to not only achieve an appropriate level of functionality with your server technology and applications, but to achieve a level of integration with your network, security, and endpoint technology strategies that maximizes your overall technology.

Endpoint Technology

Endpoint technology, which provides the interface between your IT investment and your users, is an essential component to the alignment of technology with your business goals since it is the delivery mechanism for the technology to the revenue-generating resources, your people. In conjunction with or resulting from an in depth requirements analysis, STIGroup provides services including product selection and specification, integration with core and best-of-breed software and hardware products, and implementation strategy and execution for a wide variety of endpoint technology products.

Our product expertise includes desktop technology, laptops and tablets, mobility (BYOD) and peripheral components such as biometric and digital signature technologies. We deliver a significant value to our clients in the endpoint technology area by integrating operating system technologies, such as Windows and Linux, with security-specific technologies that deal with authentication, encryption, monitoring, and policy enforcement, all while achieving the appropriate level of functionality your business applications require.

Managed IT Our Managed IT (“MIT”) practice maintains a team of skilled engineers to support 24x7 monitoring, management and response processes that ensure all relevant availability and performance levels are maintained. A dedicated support manager ensures all support services are being provided effectively and within contracted SLAs. Our support services team is comprised of engineers who design and implement network and system infrastructures. This in-depth system integration knowledge enables our team to quickly identify issues and resolutions. The MIT Practice provides our clients with an escalation point to address complex issues and bring them to a timely resolution. Regular monitoring console checks and real-time alerting systems are employed to ensure that issues are identified in a proactive fashion. Clients are able to interact with the MIT team via a customized ticketing system, thru which all issues are tracked and addressed in accordance with contracted SLAs.

Secure Technology Integration Group, Ltd. Profile

STIGroup is an Information Security and IT Integration Consulting firm founded in 1999 in New York. STIGroup provides a unique, proven approach to consulting, bridging the gap between business goals and Information Technology. We strive to exceed client expectations by constantly focusing on our people and processes, reinventing ourselves and improving on our service excellence. Our analysts, engineers and consultants dedicate themselves to the highest quality standards thru constant self-improvement, increased efficiency, experience, and professionalism.

As industry leaders in Information Security and Technology Integration, STIGroup engages our clients from the beginning of a project to completion and beyond. STIGroup offers not only requirements analysis and design services, but implementation and management and monitoring services as well. We provide the full lifecycle of Information Security Program management and IT solutions.

Description of IT Professional Services and Pricing Part Number

Functional Responsibility: Responsible for accurate installation of hardware and software with supervision.

Requirements: High school degree with 2 years general experience.

$98.08

Functional Responsibility: Responsible for the accurate implementation of computer engineering tasks and follows procedures with minimal supervision.

Requirements: Associate's degree in Computer Science, Information Systems, Information Security, Engineering or a related field with 2 years general experience. 4 years of general experience is considered equivalent to associate's degree. 1 year trade school certification with 2 years general experience is considered equivalent to associate’s degree.

$139.20

Functional Responsibility: Provides specific technical expertise to the project in most areas of technical implementation.

Requirements: Bachelor’s degree in Computer Science, Information Systems, Information Security, Engineering or a related field with 4 years of experience doing cyber security activities and/or enterprise level technology implementations. 6 years of specific experience doing cyber security activities and/or enterprise level technology implementations is considered equivalent to bachelor’s degree.

$173.17

Functional Responsibility: Responsible for the successful execution of major projects and initiatives of significant complexity and importance. Provides specific technical expertise to the project in all areas of technical implementation.

Requirements: Bachelors (or equivalent) 8 years of experience doing cyber security activities and/or enterprise level technology implementations.

$202.41

Functional Responsibility: Responsible for the successful execution of major projects and initiatives of high complexity and importance.

Requirements: Bachelors (or equivalent) 12+ years’ experience doing enterprise information security and/or enterprise IT consulting activities.

$243.43

Functional Responsibility: Responsible for maintaining subject matter expert level knowledge.

Requirements: Masters Degree (or equivalent) 12+ years’ experience doing enterprise information security and/or enterprise IT consulting activities.

$281.63

_1465132501.vsd

_1465132504.vsd