Draft_PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

U.S. Army Cyber Protection Brigade

Advanced Security Onion Training

PART 1

GENERAL INFORMATION

1. General: This is a non-personnel services contract to provide advanced individual training and low density subject matter expertise enhancement cyber training and information technology (IT) support. The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, tools, materials, and other items and non-personal services necessary to provide instruction and support services in a classroom environment as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: Security Onion Solutions has provided support on several occasions in the past to the U.S. Army Cyber Protection Brigade (USACPB). Security Onion is a critical tool utilized by CPTs. The USACPB requires Cyber Protection Teams (CPTs) to obtain advanced individual cyber training and certification in low density subject matter expertise to support the needs of the United States Cyber Command (USCC) Cyber Mission Force (CMF) training program.

1.3 Objectives: Provide high-quality management and instructors for curriculum development and instruction of training in Security Onion (and associated tools) conducted for the USACPB.

1.4 Scope: This Performance Work Statement establishes and describes the major functions required to support the USACPB. The effort includes duties in support of cyber security instruction and classroom coordination. The cyber security instruction will occur at Fort Gordon, GA in six iterations. The services are required to support training and education critical subject matter expertise areas. Two of the six iterations will be Security Onion basic training classes. The remaining four iterations will be Security Onion. The student population includes personnel from CPTs, Military and DA Civilian, performing defensive cyberspace operations.

0. Period of Performance: The period of performance shall be defined as a 12 month period. This contract will have one (1) option year at the discretion of the Government. There shall be no penalty on the Government if the option year is not executed.

1.6 General Information

1.6.1 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which they assure themselves that their work complies with the requirement of the contract.

1.6.2 Quality Assurance: The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Federal Government Holidays:

1.6.4 Hours of Operation: The contractor is responsible for conducting business, between the hours of 8 A.M. to 5 P.M. Monday thru Friday, except when the Government facility is closed due to Federal Holidays, emergencies, administrative closings, or similar Government directed facility closings. The work schedule may vary based on training requirements but will adhere to a five (5) day, 40 hour week. The Contractor must at all times maintain an adequate workforce for facilitation of training defined within this PWS when the Government facility is not closed for the above reasons.

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday. Holidays falling on a Sunday will be observed on the following Monday. In addition to the days designated as holidays, the Government any other day designated by Federal Statute, Executive Order or Presidential Proclamation.

1.6.5 Place of Performance: The work to be performed under this contract will be performed at Fort Gordon, GA.

1.6.6 Type of Contract: The government will award a firm fixed price contract.

1.6.7 Security Requirements:

1.6.7.1 Contractor employees performing on this contract/task order must be a U.S. citizen. Additionally, contractor employees must be able to pass a criminal background check in accordance with the Fort Gordon Visitor Control Center and Physical Security Officer in order obtain a visitor’s pass to conduct work on this contract on the Army Installation. All personnel entering or exiting the installation may experience a delay due to vehicle inspections, registration checks, verification of seat belt use, etc. All vehicles and personnel are subject to search and seizure. The search and seizure provisions shall apply to contractor personnel while within Fort Gordon's area of jurisdiction. Contractor personnel shall comply with all entry control requirements and security policies/procedures in effect. Security procedures may change without notice. Work on this contract will be operating in an unclassified training environment.

1.6.7.2 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information, and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured. The contractor shall utilize qualified personnel to maintain and manage classrooms and labs, to teach, etc. associated with Security Onion training.

1.6.8 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the contractor's performance and the contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.9 Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.10 Records of Training: The contractor shall maintain a copy of all training/certification records of individuals attending training for a minimum of two (2) years from the last day of training conducted executed under this contract.

1.6.11 Supervision of Contractor Employees: The Government will not exercise any supervision or control over Contractor or subcontractor employees while performing work under the contract. Such employees shall be accountable solely to the Contractor, not the Government. The Contractor, in turn, shall be accountable to the Government for Contractor or subcontractor employees.

1.6.12 Organizational Conflict of Interest: The contractor shall not divulge any information accessed and obtained during the course of performing this task to other contractor staff or anyone outside the government. In addition to any organizational conflict of interest provision, contractor personnel assigned to this task order shall be required, prior to beginning work, to sign a non-disclosure statement for the government agreeing not to share any information or data with other contractor personnel not assigned to the project or, if assigned to the project, who has not signed such a non-disclosure statement. Signed nondisclosure statements shall be furnished to the COR prior to contract performance. Failure to adhere to these non-disclosure safeguards may result in termination of this task. Final authorship and copyright (if required) of any deliverables shall reside with the government. The contractor shall not gain any unfair advantage. The contractor shall identify any organizational conflict of interest clauses they or their subcontractors are subject to, current or within three years of federal government contract services, by providing, with their offer, a copy of the clause, a description of the contract services performed, a contract number, a governmental point of contact, and a phone number for that point of contact.

1.6.13 Privacy Act: All contract personnel assigned to this task shall have access to information that may be subject to the Privacy Act of 1974. The contractor is responsible for ensuring all assigned contract personnel are briefed on Privacy Act requirements.

The contractor shall ensure that all assigned personnel understand applicable security policies and directives. Personnel who knowingly violate security policies or directives are subject to immediate removal from any work relating to this contract.

Contractor personnel shall have routine and unavoidable access to proprietary information which they are required to protect. Personnel applied to the tasks in this PWS may not work on other tasks for the contractor or for any other agency without a formal written request, and written consent granted by, the contracting officer.

1.6.14 Uses and Safeguarding of Information: Information from the secure website is considered to be proprietary in nature when the contract number and contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the contractor name and contract number associated with the data.

1.6.15 Security.

1.6.15.1 Anti-Terrorism (AT) Level I Training. All contractor employees, including subcontractors, assigned to this contract shall receive an initial Antiterrorism Level I Brief by a certified ATO Level II Officer within 30 days of reporting for duty. (Monthly briefings will be offered by the Garrison Antiterrorism Officer.) Annual refresher Antiterrorism Level I Training shall be completed on-line at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf or they may attend the monthly training offered by the Garrison ATO. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR and unit/activity security manager. (Ref Department of the Army, US Army Contracting Agency, SFCA-CO, 5 Sep 07, subject: Incorporation of Measures into the Contracting Process and AR 525-13, Antiterrorism).

1.6.15.2 Access and General Protection/Security Policy and Procedures. This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. CONTRACT ADMINISTRATOR. The official Government representative delegated authority by the Contracting Officer to administer a contract. This individual is normally a member of the appropriate Contracting/Procurement career field and advises on all technical contractual matters.

2.1.2. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.3. CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.4. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.6. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.7. GOVERNMENT-FURNISHED PROPERTY (GFP) OR GOVERNMENT PROPERTY (GP). Property in the position of, or directly acquired by, the Government and subsequently made available to the Contractor.

2.1.8. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.9. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.10. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are acceptable in accordance with established standards and requirements of this contract.

2.1.11. QUALITY ASSURANCE SPECIALIST. An official Government representative concerned with matters pertaining to the contract administration process and quality assurance/quality control. Acts as technical advisor to the Contracting Officer in these areas.

2.1.12. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.13. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.14. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.15. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.16. WORK WEEK. Monday through Friday, except for Federal holidays unless specified otherwise.

2.2. ACRONYMS:

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1 Facilities: The Government will provide the necessary workspace for the contractor staff to provide the support outlined in the PWS to include classroom, desk space, and other items necessary to maintain a training environment.

3.2 Utilities: The Government will provide electricity, water, phone service, student computers, and network services to the building. The Contractor shall instruct employees in utility conservation practices. The contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off lights and information systems after training is accomplished at the end of each day.

3.3 Equipment: The Government will provide computers for student use. The Government not will provide contractor personnel instructor computer equipment, monitors, printers, or fax machines. The contractor shall have access to copy machines. The contractor shall be responsible for any loss or destruction of or damage to items of Government property that are removed from the installation premises by the contractor – with or without Government approval.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2 Contract Management: The contractor shall provide all management, administration, security, quality control, and all else required to ensure successful completion of all deliverables.

4.3 Personnel: If the contractor uses additional personnel to directly facilitate the training and instruction, the contractor shall furnish adequate supervision and the labor necessary to perform all services in an orderly, timely, and efficient manner. The contractor shall utilize qualified and experienced employees capable of achieving the goals established in the contract. All personnel will maintain current qualifications to meet mission requirements. Contractor personnel are employees of the contractor and under its administrative control and supervision. The contractor through its personnel shall perform tasks herein. The contractor shall select, supervise, and exercise control and direction over his employees under this contract. The Government will not exercise any supervision or control over the contractor employees in its performance of contractual services under this contract. The contractor shall ensure that no prohibited personal services are performed under this contract.

4.4 Equipment: The contractor shall provide all necessary computer equipment, software, and training material necessary to conduct training.

4.5 Training Material: The contractor shall provide a copy of the training material to students that can be used for reference after the conclusion of training.

PART 5

SPECIFIC TASKS

5. SPECIFIC TASKS:

5.1 Program Management: Should the contractor use more than one personnel. The contractor shall provide complete program management and administrative tasks to ensure the requirements of the contract are met and to ensure the contractor adequately controls and supervises all personnel who perform services under this contract. The program manager shall be the focal point for all issues and shall keep the Government fully informed, both verbally and in writing. The contractor shall provide all necessary personnel, administrative, financial, and managerial resources required to support this contract. The Program Manager shall also be responsible for the following:

1. Shall supervise, coordinate work schedules, resolve minor concerns/issues and complete the administrative tasks associated with this PWS (e.g. Exhibit 2 deliverables, 5.3, invoicing and 1.6).

1. Have the capability and authority to resolve and respond to issues directly with the COR.

1. Provide analysis of project requirements and accurate cost estimates. Provide and gather required information to assist with coordination support efforts.

1. Monitor trends and upcoming changes within the Army Cyber community and develops recommended improvements.

1. Ensure instructor/writer/developers are evaluated (if applicable), and demonstrate subject matter expertise in various network monitoring tools, IT Security policies, hardware, software, and communication technologies.

1. Possess the skill sets to supervise contractor employees (if applicable). Be proficient in conflict resolution.

1. Be capable of coordinating work schedules/assignments of contractor employees.

1. Be able to communicate orally and in writing with COR.

5.2 Instruction, Training Curriculum, Lab and Classroom Management:

1. Manage and maintain accountability of the classroom presentation equipment and classroom furniture, e.g. identify furniture or equipment issues and report them to proper personnel. All equipment issues will be reported to the Facility Manager or COR as soon as identified.

1. Install and/or operate classroom required software on IT equipment.

1. Advanced Training classes will encompass specifically focused instruction on Snort, Bro, ELSA, and Suricata tools in addition to the ELK log aggregation tool in the curriculum.

1. Each class will provide hands-on labs to reinforce training concepts.

1. Maintain and report student attendance, records, and statistics. Evaluate students and report academic concerns to the COR when warranted by classroom performance, e.g., academic test failure, excessive absences, etc.

1. From the results of the students’ critiques, review and modify all lessons, material, labs, and instruction to ensure it imparts the maximum amount of value in the minimum amount of time.

1. Collect, maintain, and analyze student and customer feedback on instructors, material, and/or curriculum. Student feedback shall provide information on instructor capabilities, curriculum relevance, and course updates, which address at a minimum: components recommend for sustainment, removal and/or addition to improve capability and functionality. The contractor shall collect, maintain, analyze, and modify critique question and format.

5.3 Invoicing:

5.3.1 Format: All invoices shall be submitted in WAWF (https://wawf.eb.mil/) as a 2-in-1 invoice with all applicable monthly documentation attached. Monthly documentation includes Monthly Status Reports (MSR), In- Progress Reviews (IPR), and other reports where applicable as stated in the PWS. Monthly documentation may not be submitted via email. Invoices submitted as anything other than a 2-in-1 and/or without attached monthly documentation will be rejected.

5.3.2 A contract employee with the authority to bind the company contractually shall certify all invoices. Invoices shall be submitted no later than (NLT) ten days after the end of each month (30-day period), depending on the contract award date. Failure to submit invoices in a timely manner is a direct violation of this contract agreement. The government will have the right to exercise a penalty cost, due to the contractor being out of compliance of this contract agreement.

5.3.3 All invoices submitted at the end of the period of performance (each year) shall state “final invoice” and be clearly marked as base period, option period 1, option period 2. This annotation shall be accomplished in Wide Area Workflow Invoice 2-in-1 section, under Tab Misc. Info, and in the area of Initiator Information Comment.

TECHNICAL EXHIBIT 1

PERFORMANCE REQUIREMENTS SUMMARY

PERFORMANCE REQUIREMENTS SUMMARY

Advanced Security Onion Training

5.0

Documents must be free of error 95% of the time.

TECHNICAL EXHIBIT 2

DELIVERABLES

Lesson Plan/Training Material and Updates. (CDRL A001). The contractor shall update the curriculum, as determined by the Government:

Soft (digital) copy of completed course materials to include: references used in accordance with formats defined by CLC. The following are examples (but not all inclusive) of required course materials: lesson plans, syllabi, lecture presentations, scenarios, instructor notes and slides, student guides, instructor guides, evaluations, progress checks, handouts, exercise materials, training guides, student critique forms, schedules, and tailored training packets. The contractor shall provide soft copies of the material as required by the government.

Hard copies of complete, current, and accurate course materials to include references used with 5.1 above shall be maintained in a government provided storage area for review by the contractor and the government. All hard copy course material shall be marked with the appropriate classification. The contractor shall ensure that all updates for hard copy reference material are current before the commencement of a class. The contractor shall provide hard copies of the material as required by the government.

The government will review and provide remarks and comments NLT two (2) weeks after receiving deliverables. Return time may vary based on mission requirements.

Training Records. (CDRL A002). The contractor shall provide certificates of training to students following the successful completion of class. In addition to the contractor maintaining a copy of all training/certification records of individuals attending training for a minimum of two years from the last day of training conducted executed under this contract, the contractor shall provide a soft (digital) copy of certificates to the COR NLT one (1) week following the completion of each class.

Quality Control Plan. (CRDL A003). The contractor shall prepare a Quality Control Plan (QCP). The contractor shall provide a QCP upon the Government’s request. Initially the QCP should be delivered to the Government within two (2) weeks after the contract start date. Revisions should be submitted for Government approval as the contractor make adjustments to the QCP.

End of Course Feedback. (CDRL A004). The contractor shall provide end of course feedback to students of each class. Following the each class, no later than one (1) week after the completion of a class, the contractor shall provide all student feedback to the Contracting Officer’s Representative (COR).