GSA Schedule

Contract Period: 09/05/2018 – 09/04/2023

Contract Number: 47QTCA18D00JZ

Features and Benefits:

• Multiple Award Schedule: Structured as an Indefinite Delivery/Indefinite Quantity (IDIQ) Multiple Award Schedule (MAS) with a 5-year base period and three 5-year option periods
• Pre-vetted Suppliers: Agencies can purchase from experienced suppliers that have been thoroughly evaluated by the GSA
• Predefined Terms and Conditions: Terms and Conditions are established at the master contract level with flexibility to customize further at the task order level
• Contract Options: Offers multiple contract options including Fixed Firm Price (FFP), Time and Materials (T&M), and Labor Hour
• Blanket Purchase Agreements: Allows for BPAs to be created for recurring needs or indefinite requirements over several years
• Widespread Accessibility: Available for use by U.S. Federal departments, agencies and offices, including the U.S. Military and qualified state and local agencies
• Cost-Effective: Pre-negotiated rates offer agencies competitive, best value pricing
• Simplified Acquisition: Reduces typical procurement lead times and related costs by pre-qualifying firms and requiring only three or more firms to compete for a procurement

Highly Adaptive Cybersecurity Services (HACS)

GSA established the Highly Adaptive Cybersecurity Services (HACS) Special Item Number (SIN) on Multiple Award Schedule (MAS) to provide agencies quicker access to key support services from technically evaluated vendors that will:

• Expand agencies’ capacity to test their high-priority IT systems;
• Rapidly address potential vulnerabilities; and
• Stop adversaries before they impact our networks.

The HACS SIN offers:

• Access to a pool of technically evaluated cybersecurity vendors
• Rapid ordering and deployment of services
• Reduction in open market ordering and contract duplication
• Cybersecurity/acquisition support resources from GSA

The scope of the HACS SIN includes proactive and reactive cybersecurity services. Assessment services needed for systems categorized as High Value Assets (HVA) are also within scope of this SIN. It includes Risk and Vulnerability Assessments (RVA), Security Architecture Review (SAR), and Systems Security Engineering (SSE). Additionally, the scope of the SIN includes services for the seven-step Risk Management Framework (RMF), and Security Operations Center (SOC) services.

• The seven-step RMF includes preparation, information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. RMF activities may also include Information Security Continuous Monitoring Assessment (ISCMA) which evaluate organization-wide ISCM implementations, and Federal Incident Response Evaluations (FIREs), which assess an organization’s incident management functions.
• SOC services are services such as: 24x7x365 monitoring and analysis, traffic analysis, incident response and coordination, penetration testing, anti-virus management, intrusion detection and prevention, and information sharing.

There are five subcategories under the HACS SIN 132-45. Assurit has successfully passed a technical evaluation for each subcategory:

• High Value Asset Assessments – include Risk and Vulnerability Assessment (RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. See the section below on RVA for details on those services. Security Architecture Review (SAR) evaluates a subset of the agency’s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems. SAR provides a holistic analysis of how an HVA’s individual security components integrate and operate, including how data is protected during operations. Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on but is not limited to the following security areas: perimeter security, network security, endpoint security, application security, physical security, and data security.
• Risk and Vulnerability Assessment – assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing.
• Cyber Hunt – activities respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunts start with the premise that threat actors known to target some organizations in a specific industry or with specific systems are likely to also target other organizations in the same industry or with the same systems.
• Incident Response – services help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.
• Penetration Testing – is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

Contact us to learn more about procuring our services through our GSA Multiple Award Schedule.