GSA IT70 HACs

The GSA HACS SINs acknowledge XOR Security’s exceptional capabilities in specific cyber and information security disciplines. The evaluation process for the GSA award was comprehensive, including extensive written documentation as well as oral technical interviews with key leaders and subject matter experts.

XOR Security-GSA IT70-Man typing on computer system

GSA HACS Special Item Numbers include:

54151HACS High Value Asset Assessments:

Include Risk and Vulnerability Assessment (RVA) which assesses threats and vulnerabilities, determines deviations from acceptable configurations, enterprise or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. See the section below on RVA for details on those services.

Security Architecture Review (SAR) evaluates a subset of the agency’s HVA security posture to determine whether the agency has properly architected its cybersecurity solutions and ensures that agency leadership fully understands the risks inherent in the implemented cybersecurity solution. The SAR process utilizes in-person interviews, documentation reviews, and leading practice evaluations of the HVA environment and supporting systems. SAR provides a holistic analysis of how an HVA’s individual security components integrate and operate, including how data is protected during operations.
Systems Security Engineering (SSE) identifies security vulnerabilities and minimizes or contains risks associated with these vulnerabilities spanning the Systems Development Life Cycle. SSE focuses on, but is not limited to the following security areas: perimeter security, network security, endpoint security, application security, physical security, and data security.

54151HACS Risk and Vulnerability Assessment:

Assessments of threats and vulnerabilities, determines deviations from acceptable configurations, enterprise, or local policy, assesses the level of risk, and develops and/or recommends appropriate mitigation countermeasures in operational and non-operational situations. This SIN includes services such as:

Network mapping
Vulnerability scanning
Phishing assessment
Wireless assessment

Web application assessment
Operating System Security Assessments (OSSA)
Database assessment
Penetration testing

54151HACS Cyber Hunt

Responses to crisis or urgent situations within the pertinent domain to mitigate immediate and potential threats. Cyber Hunt activities start with the premise that threat actors known to target some organizations in a specific industry, or specific systems, are likely to also target other organizations in the same industry or with the same systems.

54151HACS Incident Response

Services to help organizations impacted by a cybersecurity compromise determine the extent of the incident, remove the adversary from their systems, and restore networks to a more secure state.

54151HACS Penetration Testing

security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network.