MAS - The Mako Group Llc - GS35F357DA

For Ordering and Contract Administration:

Zachary Jones | (317) 456-2884 | federalsales@makopro.com | www.makopro.com

Business size: Small

On-line access to contract ordering information, terms and conditions, up-to-date pricing, and the option to create an electronic delivery order are available through GSA Advantage!®, a menu-driven database system.

The INTERNET address GSA Advantage!® is: GSAAdvantage.gov.

General Purpose Commercial Information Technology Equipment, Software and Services (Schedule 70)

Special Item Numbers:

132-51 Information Technology Professional Services 132-45A Penetration Testing 132-45D Risk and Vulnerability Assessments

FSC/PSC Class D302 IT AND TELECOM- SYSTEMS DEVELOPMENT FSC/PSC Class D306 IT AND TELECOM- SYSTEMS ANALYSIS FSC/PSC Class D307 IT AND TELECOM- IT STRATEGY AND ARCHITECTURE FSC/PSC Class D310 IT AND TELECOM- CYBER SECURITY AND DATA BACKUP FSC/PSC Class D399 IT AND TELECOM- OTHER IT AND TELECOMMUNICATIONS

Contract number: GS-35F-357DA

For more information on ordering from Federal Supply Schedules click on the FSS Schedules button at fss.gsa.gov.

Mailing Address:

PO Box 209 Columbia City, IN 46725 www.makopro.com The Mako Group, LLC

877-247-(MAKO)

contactus@makopro.com

Cybersecurity Risk Audit Advisory

Corporate Office:

1905 South New Market St, Ste. 230 Carmel, IN 46032

DC Office:

641 S Street NW Washington, DC 20001

Table of Contents:

Last Modified: August 2, 2018; Modification ID: OVIPV9ZP

Customer Information:

Labor Category Pricing and Descriptions

Education and Experience Equivalencies:

Core Competencies and Relevant Experience

Last Modified: August 2, 2018; Modification ID: LIRCPXLP

Customer Information:

1. Rates and Descriptions:

Special Item Number (SIN) Labor Rate Labor Category Descriptions 132-51 – IT Professional Services

See page 5 for Labor Rates and corresponding descriptions 132-45A – Penetration Testing 132-45D – Risk and Vulnerability Assessments

2. Maximum Order:

$500,000 is the maximum order under the enclosed Price Reduction Terms and Conditions.

3. Minimum Order:

$100 is the minimum order under the enclosed Price Reduction Terms and Conditions.

4. Geographic Coverage (Area of Operation):

The services offered under SINs 132-51, 132-45A and 132-45D are domestic delivery only.

Domestic delivery is delivery within the 48 contiguous states, Alaska, Hawaii, Puerto Rico, Washington, DC and U.S. Territories. Domestic delivery also includes a port or consolidation point, within the aforementioned areas, for orders received from overseas activities.

Overseas delivery is delivery to points outside of the 48 contiguous states, Washington, DC, Alaska, Hawaii, Puerto Rico and U.S. Territories.

5. Points of Production:

All work will be performed out of The Mako Group, LLC’s offices or at the Ordering Activities facility.

6. Discount from List Prices:

Pricelist Discounts are included in the Labor Rates Table on page 5.

7. Quantity Discounts:

- 1% discount for orders over $100,000

- 2% discount for orders over $300,000

8. Prompt Payment Terms:

1% 20 days/ Net 30

9. Government Purchase Cards:

a. Government Purchase Cards are accepted at or below the micro-purchase threshold.

b. Government Purchase Cards may be accepted above the micro-purchase threshold on a case by case basis.

10. Foreign Items:

Not Applicable

11. Time of Delivery:

The Contractor shall deliver to destination within the number of calendar days after receipt of order (ARO), as set forth below:

a. Standard Delivery Time – As negotiated between The Mako Group, LLC and the Ordering Activity

b. Expedited Delivery – Not Applicable

c. Overnight and 2-Day Delivery – Not Applicable

d. Urgent Requirements – When the Federal Supply Schedule contract delivery period does not meet the bona fide urgent delivery requirements of an ordering activity, ordering activities are encouraged, if time permits, to contact the Contractor for the purpose of obtaining accelerated delivery. The Contractor shall reply to the inquiry within three workdays after receipt. (Telephonic replies shall be confirmed by the Contractor in writing.) If the Contractor offers an accelerated delivery time acceptable to the ordering activity, any order(s) placed pursuant to the agreed upon accelerated delivery time frame shall be delivered within this shorter delivery time and in accordance with all other terms and conditions of the contract.

12. F.O.B. Point(s):

Destination

13. Ordering:

a. Ordering Address(es) – The Mako Group, LLC Attn: Zachary Jones 1905 South New Market Street, Suite 230 Carmel, IN 46032 Phone: (317) 456-2884 | Fax: (260) 494-1696 Email: federalsales@makopro.com

b. Ordering Procedures:

For supplies and services, the ordering procedures and information on Blanket Purchase Agreements (BPA’s) are found in FAR 8.405 – Ordering Procedures for Federal Supply Schedules.

14. Payment Address(es):

EFT Information Check Remittance Address Overnight Remittance Only Included with invoice. The Mako Group, LLC

PO Box 209 Columbia City, IN 46725

The Mako Group, LLC 1905 South New Market St.

Suite 230 Carmel, IN 46032

15. Warranty Provision:

Not Applicable

16. Export Packing Charges:

17. Terms and Conditions of Government Purchase Card Acceptance:

Government Purchase Cards are accepted in accordance with the answers in parts 9a and 9b.

18. Terms and Conditions of Rental, Maintenance, and Repair:

19. Terms and Conditions of Installation:

Not Applicable

20. Terms and Conditions of Repair Parts Indicating Date of Parts Price Lists and any discounts from list prices:

a. Terms and Conditions for Any Other Services:

21. List of Service and Distribution Points:

Not Applicable

22. List of Participating Dealers:

Not Applicable

23. Preventative Maintenance:

24. Special Attributes and Section 508 Compliance:

a. Special Attributes Such as Environmental Attributes:

b. Indicate that Section 508 compliance information is available on Electronic and Information Technology (EIT) supplies and services and show where full details can be found (e.g. contractor’s website or other location.) The EIT standards can he found at www.Section5O8.gov/.

Not Applicable

25. Data Universal Number System (DUNS) Number:

020666747

26. Notification Regarding Registration in Central Contractor Registration (CCR) Database:

The Mako Group, LLC is registered in the System for Award Management (SAM).

Labor Category Pricing and Descriptions

The following represents The Mako Group’s service offerings under SINs 132-51 – IT Professional Services, 132-45A – Penetration Testing and 132-45D – Risk and Vulnerability Assessments under GSA Schedule 70.

The sections below detail the labor categories, services and backgrounds relevant to projects performed under this SIN by The Mako Group. All prices are applicable until June 9, 2021.

132-51 IT Professional Services, 132-45A Penetration Testing and 132-45D Risk and Vulnerability Assessments

GSA Schedule Rates

Labor Category Year 1 Year 2 Year 3 Year 4 Year 5

Principal/Senior Director $294.26 $298.67 $303.15 $307.70 $312.31 Information Security Director $244.38 $248.05 $251.77 $255.55 $259.38

Audit & Risk Director $244.38 $248.05 $251.77 $255.55 $259.38 Senior Network Consultant $214.46 $217.68 $220.94 $224.25 $227.62

Senior Information Security Manager $184.53 $187.30 $190.11 $192.96 $195.86 Senior Audit & Risk Manager $164.58 $167.05 $169.56 $172.10 $174.68

Information Security Project Manager $129.67 $131.62 $133.59 $135.60 $137.63 Audit & Risk Project Manager $129.67 $131.62 $133.59 $135.60 $137.63

Security Consultant $99.75 $101.25 $102.76 $104.31 $105.87 Technical Project Coordinator $74.81 $75.93 $77.07 $78.23 $79.40

Principal/Senior Director:

Minimum Education: Bachelor’s Degree (BS/BA) or equivalent plus 2 related certifications.

Minimum Experience: A minimum of 15 years of industry experience in the field of information technology (IT), information security, internal/external audit, business risk advising or executive level management, including at least 4 years of related management experience.

General Experience: Experience surrounding client management, large project implementation, industry strategy, new service development and resource allocation. Possesses industry specific knowledge in IT, information security, controls testing, audit and/or business risk advising, in addition to, directly related management experience.

Experience also includes:

IT strategy Information security management Client objective coordination Quality assurance management

Project definition and strategy development

Resource planning and allocation

Functional Responsibility: Manages overall approach and strategy for addressing client goals, technical requirements and larger project objectives. Responsible for developing specialized and individualized solutions and deploying The Mako Group’s assets to adequately manage projects.

Ensures timeliness and quality in all milestones and deliverables throughout the relationship of The Mako Group and the client.

Information Security Director:

Minimum Education: Bachelor’s Degree (BS/BA) or equivalent and 2 related certifications.

Minimum Experience: At least 10 years of industry experience in the field of IT, information security or network testing including at least 2 years of related management experience.

General Experience: Possesses unique experience working in the IT or relevant consulting field, specifically around information security and controls testing. Develops larger strategies around engagement effectiveness, quality assurance and security assessment methods.

The Security Director has experience in the following initiatives:

NIST Cybersecurity Framework implementation

Technical network evaluation Cross-organization objective management

Incident response planning Security plan development

Functional Responsibility: Responsible for managing engagements and generating individualize solutions for client projects. Maintains multiple certifications and regularly engages in continuing professional education and expansion opportunities. Develops information security strategies based on a variety of frameworks and industry specific norms and requirements. Assures quality and timely completion of all project milestones and deliverables. Maintains a regular communication schedule with client.

Audit & Risk Director:

Minimum Education: Bachelor’s Degree (BS/BA) or equivalent and 2 related certifications.

Minimum Experience: At least 10 years of industry experience in audit or business risk analysis, including at least 2 years of related management experience.

General Experience: Possesses unique experience working in the field of internal audit and/or business risk management specifically around information security and controls testing. Maintains multiple certifications and regularly engages in continuing professional education and expansion opportunities. Develops larger strategies around engagement effectiveness, quality assurance and audit methods.

The Audit Director has experience in the following initiatives:

Sarbanes-Oxley (SOX) 404 evaluation and testing

ISO 27001 and NIST security framework control mapping

Service Organization Control (SOC) reports

Enterprise Risk Management assessments

Internal Control assessments Project management Operational and financial audits

Functional Responsibility: Responsible for planning and managing engagements and generating individualized solutions for client projects. Develops audit strategies based on a variety of frameworks and industry specific norms and requirements. Assures quality and timely completion of all project milestones and deliverables. Maintains a regular communication schedule with client and provides advice on control approaches, best practices and helping with routine issues within the scope of an engagement.

Senior Network Consultant:

Minimum Education: Bachelor’s Degree (BS/BA) or equivalent and 3 related certifications.

Minimum Experience: At least 10 years of industry experience in the field of information technology, information security or network testing.

General Experience: Experience includes assisting organizations across a variety of industries, identifying gaps in security and providing cost effective remediation recommendations for those gaps. Experience with large healthcare systems, financial institutions, manufacturing entities and government organizations.

Additional participation or experience with the following:

Network penetration testing Web application security Wireless penetration testing Social engineering Network configuration analysis

PCI DSS

SCADA vulnerability testing SAP software testing Information security training Open source software

Functional Responsibility: Operates as the primary resource to evaluate network vulnerabilities, system security postures and technical reviews of code or configurations. Responsible for conducting and delivering all network penetration tests, vulnerability assessments and other technical testing.

Senior Information Security Manager:

Minimum Education: Bachelor’s Degree (BS/BA) or equivalent and 1 related certification.

Minimum Experience: At least 7 years of industry experience in the field of information technology, information security or network testing.

General Experience: Experience managing complex, industry specific projects to fulfil client objectives and regulatory requirements. Develops cross discipline assessment techniques and remediation tactics with security and audit teams. Implements testing strategies and unique approaches based on industry knowledge, team experience and client environments.

Archer system integration IT project management Penetration testing and vulnerability assessments Social engineering program management

NIST 800-53

NIST CSF and ISO 270001/2 IT audits and controls testing SCADA control and risk assessments Employee security awareness training programs

Functional Responsibility: Manages all testing and assessment activity surrounding the client’s security environment. Administers interviews and environment reviews based on industry standard techniques and internal principles. Interprets test results and generates reports for all deliverables and milestones.

Senior Audit & Risk Manager:

Minimum Experience: At least 7 years of industry experience in the fields of audit or business risk analysis.

General Experience: Project management experience surrounding information security, controls testing, operational and financial audits, risk assessments and control development and implementation.

The Senior Audit Manager has experience in the following initiatives:

Internal Controls development and testing procedures

NIST cybersecurity framework assessment

IT Model Audit Rule (MAR) testing Service Organization Control(SOC) reporting

Employee security awareness training ITGC and HIPAA gap assessments SCADA control and risk assessments Internal audit Enterprise Risk Management

Functional Responsibility: Manages all testing and assessment activity surrounding the client’s security environment. Administers interviews and environment reviews based on industry standard techniques and internal principles. Interprets test results and generates reports for all deliverables and milestones. Maintains a regular communication schedule with client and provides advice on control approaches, best practices and helping with routine issues within the scope of an engagement.

Information Security Project Manager:

Minimum Experience: At least 5 years of industry experience in the fields of information technology, information security and/or network testing.

General Experience: Proficient with NIST Cybersecurity Framework, ISO 27001 and a variety of other information security frameworks and control environments. Experience in IT project management, technical testing and assessments, multi-organizational teams and milestone tracking.

GRC tool implementation

Penetration testing and vulnerability assessments Social engineering program management

NIST cybersecurity framework IT audits and controls testing SCADA control and risk assessments Employee security awareness training programs

Functional Responsibility: Manages specific project components and engagement objectives surrounding the project plan and client information security practices. Performs network testing, analysis and documentation in conjunction with a Senior Network Expert. Maintains responsibility for security expectations and objectives for engagements. Utilizes assessment tools and investigation methodologies to facilitate reviews and data collection surrounding client systems and practices. Creates project deliverables and manages review processes to ensure accuracy and integrity of all testing reports and assessment documentation.

Audit & Risk Project Manager:

Minimum Experience: At least 5 years of industry experience in the field of audit or business risk analysis.

General Experience: Experience in financial and operational audits for worldwide companies and has extensive experience with controls testing. Possesses wealth of experience with manufacturing plants, financial institutions and organizations within the life sciences industry.

Business risk assessments Enterprise Risk Management Information security program development

IT Security policy development Data risk assessments Internal Control testing

Functional Responsibility: Manages specific project components and engagement objectives surrounding the project plan. Performs control testing procedures and assessments based on a variety of control frameworks and risk assessment platforms. Conducts analysis of client risk and audit environments to ensure consistency and integrity within a project scope.

Security Consultant:

Minimum Education: High School Diploma or higher education.

Minimum Experience: 3 or more years of information technology, information security, network testing and/or consulting experience.

General Experience: Familiar with cybersecurity concepts, has experience in one or more technical areas and possesses proficiency in relevant IT, information security or network testing skillsets.

Experience in IT project management, technical testing and assessments, multi-organizational teams and milestone tracking.

Penetration testing and vulnerability assessments Social engineering program management

NIST cybersecurity framework IT audits and controls testing

Functional Responsibility: Performs various testing, reviews and evaluations at the direction of the engagement leader. Focuses on technical elements and individual processes to develop an in-depth understanding of each organization’s environment. Maintains responsibility for individual testing and auditing projects throughout the engagement. Assists with deliverable construction and presentation to clients.

Technical Project Coordinator:

Minimum Education: High School Diploma or higher education.

Minimum Experience: At least 1 year of information technology, information security, network testing and/or consulting experience.

General Experience: Experience with project management, testing, administrative tasks, content creation, presenting and/or other support tasks. Familiarity with basic concepts of information security, technology, controls, risk management and/or administrative work.

Project administration

Penetration testing and vulnerability assessments Managing project communications

Project support functions Controls testing Content development/technical writing

Functional Responsibility: Supports testing, project management, contract administration, audit and other assessment functions throughout the engagement. Performs supporting business functions and content development to support any other team members working on the project.

Education and Experience Equivalencies:

Experience to Education Equivalency:

H.S. Diploma + 4 years of relevant experience Equals Bachelor’s Degree Associate Degree + 2 years of relevant experience Equals Bachelor’s Degree

Education to Experience Equivalency:

Master’s Degree Equals Bachelor’s Degree + 3 years of relevant experience Ph.D. Equals Bachelor’s Degree + 6 years of relevant experience

The Mako Group, LLC Core Competencies and Relevant Experience

Who We Are:

The Mako Group is an audit, risk, cybersecurity and advisory firm with offices in Detroit, Fort Wayne and Indianapolis. We focus on you – on relationships, communication and impeccable deliverables.

Everything we do is in an effort to achieve the highest level of security and audit standards, beyond the minimum requirements, for you. By providing the highest quality work, using a combination of industry standards and best practices and employing senior level staff, The Mako Group saves you time, hassle and a lot of money. We do this because it makes you more secure. And because it just makes sense.

Putting these standards in place is why we are able to perform at the level we do.

How We Help:

The Mako Group offers a wide variety of services and develops an individualized approach for each client we serve. Our services include, but are not definitely not limited to:

Security

Enterprise Risk Assessment ISO 27001/27002 and NIST CSF Network Penetration Testing

Control Framework Integration SCADA Security Reviews

Security and Privacy Reviews

Social Engineering Web Application Testing

Wireless Testing

Audit

Agreed Upon Procedures Control Design and Testing

Control Mapping Financial Audits

IT Audits

Model Audit Rule Operational Audits Outsourced Audits

Project-Based Audits

SAP Access and Security Review

Sarbanes Oxley (SOX) 404/302 SOC Reports

Risk Assessments

AML

BSA

Cybersecurity

FFIEC

GLBA

HIPAA

IRS 1075

NIST

PCI

Consulting and Advisory

RSA Archer Audit Preparedness

Data Loss Prevention Governance, Risk &

Compliance

Incident Response Management Consulting

Maturity Model

SAP

Security Program Development

SIEM

Sourced CISO

SSP

Vendor Management

Policy/Procedures Development

Who We Help:

The Mako Group believes in partnerships. While engagements are completed successfully, the partnership never truly ends. The Mako Group continues to work with clients where possible, long after our engagements have ended. Our client profile includes:

Ally Financial Commonwealth of Kentucky

Cooper Standard Automotive Dart Container Corporation

Do it Best Corporation

GE-Intel Care Innovations Guardian Industries

Hilliard Lyons Indiana Pacers

Mayer Brown, LLP

Old Republic Risk Mgmt.

Parkview Health Systems

State of Indiana Sallie Mae Bank

Tampa Bay Water