Description
The MAS Consolidation effort is to modernize and simplify the buying and selling experience by consolidating GSA’s 24 legacy Multiple Award Schedules into one single Schedule, called the Multiple Award Schedule (MAS).
MAS is one of the largest contracts in the federal government. It delivers federal, state, and local customer agencies the tools and expertise needed to shorten procurement cycles, ensure compliance, and obtain the best value for innovative technology products, services and solutions. The Schedule is composed of Special Item Numbers (SINs). This is a categorization method that groups similar products, services, and solutions together to aid in the acquisition process.
Information Technology Services Subcategory SINs
The IT Services subcategory encompasses: Database planning and design, systems analysis and design, network services, programming, conversion and implementation support, network services project management and data/records management.
For more information visit: https://www.gsa.gov/technology/technology-purchasing-programs/mas-information-technology
SIN 54151HACS - Highly Adaptive Cybersecurity Services (HACS)
This includes a wide range of fields such as, the seven-step Risk Management Framework services, information assurance, virus detection, network management, situational awareness and incident response, secure web hosting, and backup, security services and, Security Operations Center (SOC) services. HACS vendors are cataloged under the 5 subcategories of High Value Asset Assessments; Risk and Vulnerability Assessments, Cyber Hunt, Incident Response, and Penetration Testing.
For more information visit: https://www.gsa.gov/technology/technology-products-services/it-security/highly-adaptive-cybersecurity-services-hacs
SBD is one of a limited number of venders to hold ALL 5 Subcategories
• High Value Asset Assessments – include Risk and Vulnerability Assessment (RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. See the section below on RVA for details on those services. Security Architecture Review (SAR) evaluates a subset of the agency’s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems. SAR provides a holistic analysis of how an HVA’s individual security components integrate and operate, including how data is protected during operations. Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on, but is not limited to the following security areas: perimeter security, network security, endpoint security, application security, physical security, and data security.
• Risk and Vulnerability Assessment – assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. The services offered in the RVA sub-category include Network Mapping, Vulnerability Scanning, Phishing Assessment, Wireless Assessment, Web Application Assessment, Operating System Security Assessment (OSSA), Database Assessment, and Penetration Testing.
• Cyber Hunt – activities respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunts start with the premise that threat actors known to target some organizations in a specific industry or with specific systems are likely to also target other organizations in the same industry or with the same systems.
• Incident Response – services help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore their networks to a more secure state.
• Penetration Testing – is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.

Contract Information
Vehicle Type
Federal Supply Schedule
Contract #
GS-35F-242GA
PoP
02/15/2017 – 02/16/2022; 02/15/2022 – 02/16/2027; 02/15/2027 – 02/16/2032; 02/15/2032 – 02/16/2037
Ceiling
N/A
Order Types
FFP, T&M, LH, CR, I, BPA
Business Size
EDWOSB
GSA eLibrary
Our team of experts are ready to help.
From data to security and everything in between, we're just a click away.