U.S. General Services Administration

Professional Services and Human Capital Categories (PSHC)

Data Breach Response and Identity

Protection Services (IPS)

SIN 541990IPS

Ordering Procedures

Updated October 12, 2023
TABLE OF CONTENTS

Introduction 3

Resources 3

Who is this Guide Written For? 3

Roles and Responsibilities 4

Authorized Users 4

Task Order Terms and Conditions 4

General Ordering Procedures 4

Step 1 - Acquisition Planning 4

● Whether to Issue a Task Order or a Blanket Purchase Agreement (BPA)

● Pricing

● NAICS Code

● Task Order Funding and Funding Limitations

● Task Order Duration

● Minimum and Maximum Order Limitations

5

5

6

7

7

7

Step 2 - Define the Requirements and Develop the RFQ 7

Step 3 - Issue the RFQ 7

Step 4 - Evaluate Quotes 7

Step 5 - Award the Task Order and Reporting Requirements 8

Step 6 - Administer the Order/Execute the Work/Close-Out the Order 8

Page 2 of 8

Revised October 2023
Introduction

With the increased demand for identity protection services and ever-changing requirements of

need by our customer agencies, the General Services Administration’s (GSA) Office of

Professional Services and Human Capital Categories (PSHC) has redefined Special Item

Number (SIN) 541990IPS as its official Data Breach Response and Identity Protection Services

(IPS) SIN on the Multiple Award Schedule (MAS).

Redefining the SIN now allows industry to provide current state-of-the-art identity protection

services (identity monitoring and notification of Personally Identifiable Information (PII) and

Protected Health Information (PHI), identity theft insurance and identity restoration services, and

protection (safeguard) of the confidentiality of PII and PHI) while giving you the ability to meet

your individual requirements.

The redefined SIN 541990IPS allows for a total solution for identity protection services and

affords the ordering office to tailor their scope for only selective segments of services found

under this SIN. For example an ordering office may have a suspected breach, but due to the

uncertainty, may only want to seek credit monitoring services that do not require call center

support, identity restoration, etc. You will now have the ability to obtain specifically what is

needed for your immediate situation.

Resources

● Online resources supporting the use of the IPS SIN are available at GSA.gov/IPS.

● OMB Memorandum M-16-14: Category Management Policy 16-2: Providing

Comprehensive Identity Protection Services, Identity Monitoring, and Data Breach

Response (Issued July 1, 2016)

● GSA eLibrary website

Who is this Guide Written for?

This guide describes the ordering process for agency users, highlighting procedures specific to

the IPS SIN. It is written for warranted Federal ordering contracting officers (OCOs) considering

or intending to use the IPS SIN. The guide addresses contracting issues and concepts unique to

the IPS SIN. It does not address general contracting issues or concepts unless necessary for

complete understanding. The guide presumes the OCO is familiar with Federal Acquisition

Regulation (FAR) 8.405 ordering procedures.

Roles and Responsibilities

GSA is responsible for the administration and management of the IPS SIN and the Schedule

contracts. Among the responsibilities GSA will meet are:

Page 3 of 8

Revised October 2023
● Monitor and evaluate performance against the IPS SIN requirements

● Review, approve, and incorporate System Security Plan (SSP) changes

● Have exclusive, non-delegable rights to modify the IPS SIN and the Schedule contracts

● Provide advice and guidance to ordering/requiring activities and OCOs regarding

procurement-related matters

● Conduct meetings with contractors as necessary

Ordering Activity responsibilities:

● Define task order requirements

● Prepare Statement of Work (SOW)/Performance Work Statement (PWS) for task order

● Issue Request for Quote (RFQ)

● Fund requirements

● Apply regulatory and statutory requirements applicable to the ordering agency

Authorized Users

Any warranted Contracting Officer from authorized users of the Schedules program, within the

scope of their delegated procurement authorities, may place orders against the IPS SIN.

Task Order Terms and Conditions

In the event of any conflict between the Schedule contract and the task order, the terms and

conditions of the contractor’s Schedule contract shall prevail over the task order.

Ordering activities may add non-conflicting terms and conditions to individual orders, to include

specific agency terms and conditions. Additionally, any clauses incorporated at the task order

level required for small business set-aside orders shall be applicable to that order even if those

clauses have not been incorporated to the Schedule contract.

General Ordering Procedures

Step 1 – Acquisition Planning

Orders against Schedule contracts and BPAs are not exempt from Acquisition Planning as

prescribed in FAR Part 7.

Conduct market research for your requirement in accordance with regulation as you would do

with any procurement. As part of sound market research, the Schedule contract terms and

conditions, Schedule contract holders, and Schedule contract pricing shall be reviewed.

Important considerations in developing your acquisition plan include:

Page 4 of 8

Revised October 2023
Whether to Issue a Task Order or a Blanket Purchase Agreement (BPA)

If you are responding to a recent breach, then a task order is the most appropriate option. If you

are in the process of preparing your agency to respond to a breach that may happen in the

future, then a BPA is more appropriate.

Pricing

Pricing is established at the Schedule contract level for a total solution of IPS. The total solution

includes the following services as outlined in Section I of the IPS Requirements Document 1A):

● Security And Security Related Reporting

● Post Award Data Incident Reporting

● Data Breach Response And Identity Theft Services

● Call Center Services

● Notification

● Credit Monitoring Services

● Identity Monitoring

● Identity Theft Insurance

● Identity Restoration Services

● Required Reports

● Data Safeguards And Disposal

● Task Order Award Reporting

Pricing for the total solution is offered in two ways: a Firm Fixed Price Per Year, Per Impacted

Individual (Per Impacted Individual) rate, and a Firm Fixed Price Per Year, Per Enrollee (Per

Enrollee) rate. Which method an agency chooses depends on the circumstances surrounding

the requirements.The table below describes the differences between the Per Impacted

Individual rate and the Per Enrollee rate.

Pricing Method Description Example

Firm Fixed Price Per

Year, Per Enrollee

The ordering agency pays the quoted price for

each Enrollee only. The Per Enrollee rate is

used in situations where you know that most

or all individuals impacted by a breach will

enroll in the services.

A Government official

mistakenly exposes the PII of

10 employees. The ordering

agency should procure total

solution services for all 10

employees at the Per Enrollee

rate because the impacted

population is small and well

defined; therefore, there is a

high likelihood that all 10

employees will enroll in the

total solution services.

Page 5 of 8

Revised October 2023
Firm Fixed Price Per

Year, Per Impacted

Individual

The ordering agency pays the quoted price

for each Impacted Individual, regardless of

enrollment status. This total solution pricing is

used when the enrollment rate of the breach

(i.e., the number of individuals impacted by a

breach who will actually enroll in identity

protection services) is unknown to your

agency. The contractor will provide notice to

every impacted individual, but only impacted

individuals who respond to the notice and

enroll in services will receive credit

monitoring, identity monitoring, etc. Note that

this method requires uncertainty as to the

number of actual enrollees. This method is

not appropriate for a small scale breach or

where there is a high likelihood that the

enrollment rate will be near 100%.

A data breach occurred

involving a database containing

PII on 10,000 members of the

public. The ordering agency

should procure total solution

services for all 10,000 people at

the Per Impacted Individual

rate. The Per Impacted

Individual rate is appropriate

because the impacted

population is large and there is

uncertainty about how many will

actually respond to the notice

and enroll in the total solution

services.

The standardized total solution offerings and units of issue allow you to make “apples-to-apples”

price comparisons between Schedule contractors under the IPS SIN. You still maintain the

flexibility to utilize this fixed pricing as a basis to request further fixed prices at the task order

level (e.g., “per product redeemed per the agreed-upon coverage period (month, year, etc.)”).

Furthermore, you have the flexibility to order some (“a la carte”) or all (“total solution”) of the

services as defined in SIN 541990IPS. There are also additional services as customized

solutions that can only be ordered in addition to IPS Requirements Document 1A Section I

services. Examples of such additional services include 1) data breach analysis/forensic

services, 2) subsequent credit reports, and 3) offline mail services in addition to online services

for those individuals who indicate that they need a different means to access information

associated with credit monitoring, identity monitoring, and identity protection.

Any order not issued on a firm fixed price basis must be justified in accordance with FAR

8.404(h)(3).

NAICS Code

The services under the IPS SIN are aligned with the North American Industrial Classification

System (NAICS) code of 541990 – All Other Professional, Scientific and Technical Services.

This NAICS code of 541990 that you assign to your task order will not necessarily be the same

code assigned to the task order award report in the Federal Procurement Data System – Next

Generation (FPDS-NG). This is due to the current FPDS-NG system limitation which defaults all

orders to the NAICS code assigned at the Schedule contract level which is shown for each

contractor in eLibrary.

Page 6 of 8

Revised October 2023
Task Order Funding and Funding Limitations

All task orders are subject to any agency funding appropriation limitations.

Task Order Duration

The period of performance for each task order awarded under the IPS SIN shall be specified in

the task order by the ordering activity. Orders issued will have their own period of performance.

Orders issued prior to but not completed before the Schedule contract expires shall be

completed (including any order options exercised) in accordance with the Schedule contract

FAR Clause 52.216-22, Indefinite Quantity.

Minimum and Maximum Order Limitations

Each Schedule contract contains FAR Clause 52.216-19, Order Limitations. The minimum order

limitation dollar value may vary depending on the contract. The minimum order limitation is

posted on each contractor’s Schedule price list. The maximum order limitation dollar value is $1

million. The maximum order limitation is the price at which an ordering agency is required to

seek additional discounts off of the awarded schedule prices.

Step 2 – Define the Requirements and Develop the RFQ

The ordering activity must follow the ordering procedures at FAR 8.405 for orders under Federal

Supply Schedules.

a. Develop a SOW in accordance with (IAW) FAR 8.405-2 if a SOW is required. The SOW

must include a description of the work to be performed, location of work, period of

performance, deliverable schedule, applicable performance standards, and any special

requirements (e.g., security clearances, travel, etc.).

b. Ensure the requirements fit within the scope of the IPS SIN.

c. The ordering activity may include agency specific regulations/terms and conditions in the

task order that do not conflict with the Schedule contract.

d. The ordering activity shall ensure all internal reviews (e.g. legal review) as required by

ordering activity policies have been completed.

e. The ordering activity agency may utilize Order Level Materials (OLM) procedures to

acquire other direct costs (ODCs) and material support items to meet the requirements

of a specific order. For more information on OLMs, see www.gsa.gov/olm.

f. Use the RFQ form and format normally prescribed and used by your agency for task

order RFQs, consistent with FAR 8.405.

Step 3 – Issue the RFQ

To ensure fair opportunity, the suggested method for issuing the task order RFQ is to utilize

GSA eBuy.

Step 4 – Evaluate Quotes

OCOs must evaluate all responses received based on the methodology stated in the task order

RFQ to maintain fairness in the ordering process and mitigate protest risk. Place the order with

the Schedule contractor that represents the best value.

Page 7 of 8

Revised October 2023
Step 5 – Award the Task Order and Reporting Requirements

Document your task order award in accordance with regulation and local policy. At a minimum,

all orders shall include the following information:

a. Complete shipping and billing addresses

b. Task order / BPA number

c. Agency order number

d. Discount terms (if applicable)

e. Period of performance

f. SIN 541990IPS

g. SOW (if required)

h. Number of units

i. Unit of measure

j. Unit price

k. Pricing Method (“Per Enrollee”, “Per Impacted Individual”, etc.)

l. Total price of order

Task order awards shall specify the number of units acquired and the awarded price per unit.

Additionally, if an order contains some (“a la carte”) services and not all (“total solution”)

services, then the task order award shall specify the number of units acquired and the awarded

price per unit for each individual service.

Order actions must be reported in FPDS within three days after execution of the action.

Email notification of the award shall also be submitted to GSA at ips_pss@gsa.gov within five

days after execution of the action. The email notification shall consist of a copy of the task order

award, including the SOW if applicable, and a brief description of the task and total price of the

order.

Step 6 – Administer the Order/Execute the Work/Close-Out the Order

The ordering activity is responsible for administering the resulting task order.

The ordering activity is responsible for ensuring that the contractor’s performance on each order

is reported in CPARS in accordance with the policies in FAR Subpart 42.15. Follow your agency

procedures for preparation, review, and submission of performance reports.

Task order files shall be closed out in accordance with FAR Subpart 4.804-1 or, if the task order

is administered by another office, 4.804-2. The procedures prescribed in FAR Subpart 4.804-5

shall be used except when it is appropriate to use the quick closeout procedures in FAR Subpart

42.708.

GSA Point of Contact: ips_pss@gsa.gov

Page 8 of 8

Revised October 2023