3_PWS_VTE_2023.10.23.docx

PERFORMANCE WORK STATEMENT (PWS) FOR

Cyber Tatanka Virtual Threat Environment

1.0 General

1.1 This is a non-personal services contract to provide Cyber Tatanka Training Event support through the provision of a Software as a Service (SaaS) Virtual Threat Environment (VTE). Vendor will also provide and manage role players who will conduct opposing forces (Red Team) activities and advise and assist personnel (Purple Team) for the duration of use of the VTE. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.2 Scope: The contractor shall provide all personnel, equipment, materials, supervision, and quality control necessary to provide a vital realistic element to the Cyber Tatanka training, as defined in this PWS. Personnel assigned to this task shall possess the skills and expertise necessary to perform assigned tasks associated with this mission. There will be approximately 200 government/civilian personnel attending this training exercise.

1.3 Background: Cyber Tatanka is a partnered military/civilian exercise focused on defensive cyber operations and improving the skills of cyber professionals who work in related disciplines. The overall goal of this exercise is to build cyber security capacity through improving defensive cyber operations knowledge and efficiency of NEARNG Cyber elements and partner organizations. The VTE will provide realistic IT infrastructure in a closed environment for each team and will be used as a training tool for trainees to react to pre-built incidents managed and operated by an opposing force.

1.4 Contract Information

1.4.1 Place and Performance of Services: The contractor shall provide services for operational periods in Lincoln, Nebraska (site TBD) except when the facility/installation is closed due to local or national emergencies, administrative closings, or similar directed facility/installation closings. Location of training each year will be in Lincoln, NE, Omaha, NE, or a site within commuting distance (60 miles) of one of these two cities. Specific site of training will be determined and relayed to the vendor no later than February 1st of the year training is to be conducted.

1.4.2 Period of Performance:

1.4.2.1 Base Year – January 8, 2024, to January 7, 2025.

(a) Build Range.

(b) Provide Training (June 3-14, 2024)

(c) 200 participants

1.4.2.2 Option Year One - January 8, 2025, to January 7, 2026.

(a) Update Injects – 50% change.

(b) Provide Training (TBD – Between June and August 2025)

(c) 250 participants

1.4.2.3 Option Year Two - January 8, 2026, to January 7, 2027.

(a) Update Injects – 50% change.

(b) Provide Training (TBD – Between June and August 2026)

(c) 300 participants

1.4.3 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conferences convened by the Contracting Officer in accordance with Federal Acquisition Regulations Subpart 42.5. The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contactor’s performance. At these meetings, the Contacting Officer will apprise the contractor of how the Government views the contractor’s performance and the contractor shall apprise the Government of problems, if any, being experienced. The contractor shall resolve outstanding issues raised by the Government. Contractor attendance at these meetings shall be at no additional cost to the Government.

1.4.3.1 The contractor will attend all post award conferences (see 4.1.1) with Cyber Tatanka POC prior to start of exercise. Conference attendance does not have to be in person; phone or video chat is acceptable.

1.4.4 Contract Manager (CM): The contactor shall designate a CM who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the Contracting Officer. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the Point of Contact (POC) to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the Contracting Officer. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

1.5 Details

1.5.1 Quality Control (QC): The contractor shall develop and maintain an effective QC Plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non- recurrence of defective services. The contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. After acceptance of the QCP, the contractor shall obtain the Contracting Officer’s acceptance in writing of any proposed changes to its QCP.

1.5.2 Quality Assurance (QA): The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) (defect rate(s)).

1.5.3 Recognized Holidays: The following are recognized United States (US) holidays. The contractor shall not perform services on these days:

1.5.3.1 New Year’s Day: January 1st

1.5.3.2 Martin Luther King, Jr.’s Birthday

1.5.3.3 President’s Day

1.5.3.4 Memorial Day

1.5.3.5 Juneteenth National Independence Day: June 19th

1.5.3.6 Independence Day: July 4th

1.5.3.7 Labor Day

1.5.3.8 Columbus Day

1.5.3.9 Veteran’s Day: November 11th

1.5.3.10 Thanksgiving Day

1.5.3.11 Christmas Day: December 25th

1.5.4 Contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS when the Government facility/installation is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential.

1.5.5 The contractor’s employees shall become familiar with and obey the regulations of the installation, including fire, traffic, safety and security regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times. The contractor shall ensure compliance with all regulations and orders of the installation which may affect performance.

1.5.6 Anti-Terrorism/Operation Security (AT/OPSEC):

1.5.6.1 iWATCH training. The contractor and all associated sub‐contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 5 calendar days of new employees commencing performance with the results reported to the COR 30 calendar days after contract award.

(a) The training certificate is required by the individual that will be on the ground.

1.5.7 COMSEC/IT Security: N/A

1.5.8 Protection of Personally Identifiable Information (PII). The contractor shall protect all Personally Identifiable Information (PII) encountered in the performance of services in accordance with DFARS 224.103 and DoD 5400.11, Department of Defense Privacy Program, and DoD 5400.11-R. If a PII breach results from the contractor’s violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals who’s PII has been compromised.

1.5.9 CAC Requirements: N/A

1.5.10 Trusted Associate Sponsorship System (TASS): N/A

1.5.11 Identification of Contractor Employees: All contractor personnel attending meetings, answering Government telephones and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are Government employees. The contractor shall ensure that all documents or reports produced by contractor personnel are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor’s status as a “contractor” shall be predominantly displayed in all correspondence types (to include signature blocks on e-mail) and dealings with Government or non- Government entities/ Contractor personnel shall wear identification badges distinguishing themselves as such. The badges shall have the company name, employee name and the word “contractor” displayed. The contractor shall retrieve all identification media (including vehicle passes) from their employees who depart employment for any reason. All identification media (i.e., badges and vehicles passes) shall be returned to the KO within 14 days of an employee’s departure.

1.5.12 Combating Trafficking in Persons: The United States Government has adopted a zero-tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero tolerance policy, the actions that will be taken against employees for violations of this policy. Such actions may include, but are not limited to, removal from the contract, reduction in benefits, or termination of employment. The Contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described at Federal Acquisition Regulation (FAR) 22.17.

1.5.13 Contractor Travel: All travel must be included in contract price. Maximization of telework should be utilized when prudent for the mission to minimize costs.

1.5.14 Data Rights: The Contractor has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Contractor owned and are the property of the Contractor with all rights and privileges of ownership/copyright belonging exclusively to the Contractor.

1.5.15 Organizational Conflicts of Interest (OCI): The contractor and subcontractor personnel performing services under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent OCIs, as defined in FAR Subpart 9.5. The contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.5.16 Contractor will give the Nebraska National Guard the absolute and irrevocable rights to take and use photos and images of its employees, and subcontractors on the Internet (World Wide Web), in print publications, video and multimedia presentations, and/or for any purpose which may include, but not limited to display, public relations, marketing, or design.

2.0 Definitions and Acronyms

2.1 Definitions

2.1.1 Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2 Critical Item: An item that the failure of or disclosure of which is likely to result in hazardous or unsafe conditions for individuals using, maintaining, or depending upon the item; or is likely to prevent performance of a vital Government mission.

2.1.3 Defective Service: A service output that does not meet the standard of performance associated with the PWS.

2.1.4 Deliverable: Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

2.1.5 Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.6 Physical Security: Actions that prevent the loss or damage of Government property.

2.1.7 Quality Assurance: The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.8 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.9 Quality Control: All necessary measures taken by the Contractor to ensure that the quality of a product or service shall meet contract requirements.

2.1.10 Subcontractor: One that enters a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2 Acronyms

3.0 Government Furnished Property, Material, Equipment and Services (GFP/M/E/S): The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract:

3.1 Materials: The Government will not provide any material associated with the performance of this contract.

3.2 Equipment: The Government will not provide any equipment associated with the performance of this contract.

3.3 Facilities/Land: The exercise location is to be determined no later than February 1, 2024 but will be in Lincoln, NE, Omaha, NE, or a site within commuting distance of one of these two cities. The training location will provide a 10Gbps up/down ISP connection for players to enable connectivity to VTE from Exercise Location.

3.4 Services: The Government will not provide any services associated with the performance of this contract.

4.0 Contractor Furnished Property, Materials, and Equipment (CFP/M/E): The contractor shall furnish everything required to perform the service in the PWS.

5.0 Virtual Threat Environment

5.1 Exercise Requirements

5.1.1 Provide access to SaaS range environment that includes an enterprise IT environment standard template to be replicated and used by each team and conform to the following requirements listed below. Training Exercise will include up to 15 Blue Teams and up to 200 personnel for the first year. Projected rate of growth year over year is an increase of up to five Blue Teams and up to 50 personnel. Vendor will support projected growth by expanding SaaS services to meet training need based on projected Blue Teams and participants.

5.1.2 The contractor will conduct an initial kickoff meeting (virtual) within two weeks of contract award with key exercise planners/stakeholders in order to solidify initial scope and build meeting schedule for progress updates and to facilitate requests for information. Reoccurring meetings will be held weekly until VTE is complete, but more frequently if desired by either the contractor or the exercise planners.

5.1.3 Initial Enclave Template should provide initial scope/requirements of components, topology, and overview of team resources for the Range. Topology/compositions to be implemented by vendor (after approval of exercise planners) to meet timeline and any platform constraints (technical/feasibility constraints). While size of team operating in each enclave may vary, enclaves will contain enough resources to train team of 15 people. Resources can be added or subtracted from each enclave based on final team numbers, but vendor must plan for maximum number of participants to include projected growth over the life of the contract.

5.1.4 All defensive cyber tools used by the trainees should be included and supported during NETVAL and Main events. This will allow for testing and configuration of tools needed by teams. Except in the event the tool requires licensing or external resources not available to Vendor or Planners. In the event the Vendor cannot provide a specified tool requested by the government, they can provide a listing of supportable tools as alternatives, approved by the Planners, that provide similar capabilities in order to meet timeline and cost constraints.

5.1.5 VTE must produce enough log data to simulate a realistic enterprise IT environment. Vendor will provide listing of protocols and traffic simulations to meet mission objectives, timeline, and cost constraints.

5.1.6 IT environment will need to be replicated/scaled for up to twenty enclaves for Blue Teams (representing some enterprise environment/organization that would be part of the simulated scenario) participating in the training exercise. The designation of the type of organization/team (type of institution, company, etc.) is not the requirement of the vendor, and that information will be determined between the exercise planners and the assistance of the scenario development/recommendations by the vendor.

5.1.7 VTE will be accessed via standard, current web browser (Chrome, Firefox, Edge, etc.). Exercise is BYOD and may not require participants to download of any special software for range access.

5.1.8 Planners will provide a high-bandwidth ISP connection for players to enable connectivity to VTE from Exercise Location. The Exercise location will be in Lincoln, NE, Omaha, NE, or a site within commuting distance of one of these two cities. It is the intent that a majority of players will be located at this location for the exercise. Options for remote access via public internet connection should be available for remote partners that will be working world-wide.

5.2 Exercise Development

5.2.1 VTE injects and attack methodologies will follow a general arc over five days moving from easier to detect to harder to detect with the exception of day five. Day five will be a half day of training and will stand alone from the training arc. This training arc will, in general, categorize attacks consistent with what could be seen from threat actors (mixture of both enemy TTP’s and reflection of current threats seen in the “wild” over last 6-12 months) listed below:

5.2.1.1 Day 1: Script Kiddies

5.2.1.2 Day 2: Hacktivists

5.2.1.3 Day 3: Cyber Criminals

5.2.1.4 Day 4: Advanced Persistent Threat (APT)

5.2.1.5 Day 5: Insider Threat (half day of training)

5.2.2 Changes in IP schemes will be included year over year to ensure Blue Teams do not repeat same response documentation as previous year(s).

5.2.3 Vendor will provide basic traffic flow on top of incident simulations that mimic real traffic activity through both traffic generators and automated mechanisms on the individual virtual machines that mimic real user activity (opening emails, attachments, running applications, etc.).

5.2.4 Vendor will provide a Common Operational Picture view for the main White Cell that will incorporate all the scenarios and injects real time to ensure Situational Awareness. This should also include technical VTE performance and metrics to ensure situational awareness on infrastructure resources and assist with identifying any issues of the VTE.

5.2.5 Vendor will provide a mechanism to enable situational reporting with artifact submissions to be used by Blue Teams to submit reports of observed cyber activity. This mechanism will also be utilized by Red/Purple teams to assess Blue Team findings and provide feedback on report accuracy. Preferably a web-based program that is integrated into the VTE to allow for easy submission of artifacts and other electronic based documentation produced by the team and their toolkits within the VTE.

5.2.6 The vendor will conduct a final walkthrough of the VTE for exercise planners no later than 15 days prior to the exercise start date. The intent of this walkthrough is for familiarization on the systems and tools that will be needed by the White Cell.

5.2.7 The vendor will provide one representative on-site for the entire duration of the exercise to ensure ability to coordinate with Vendor and their Support/Red/Purple Teams. All other Vendor personnel should provide at least the means to work remotely to support the exercise.

5.2.8 Player Roles and Responsibilities:

5.2.8.1 Red Team – Provides injects within VTE via established playbook/scripts based on scenarios developed.

5.2.8.2 Purple Team – Provides oversight of Blue Team inject response, evaluates effectiveness of Blue Team response TTP’s and ensures that Blue Team understands threat situation. Provides overall feedback and areas to focus improvement on.

5.2.8.3 Blue Team – Provides incident response and associated investigation activities to determine appropriate response. Provides documentation of evidence and situational reports to White Cell. Blue Teams are the primary training audience of this exercise.

5.2.8.4 White Cell/Exercise Control – Provides oversight of overall exercise execution. Will ensure coordination between all players listed above. This includes monitoring of range activities and availability of VTE through on-site vendor support person.

5.2.8.5 External Planning and Control Agencies and Organizations: The NEARNG will be partnering through Innovation Readiness Training Program with LES (Lincoln Electric Systems). Vendor may work between NEARNG and LES during the planning and execution phases as this will be a MIL/CIV combined exercise.

5.3 Exercise Support: Opposing Forces (OPFOR)

5.3.1 Vendor will assign one dedicated Red Team player at minimum per 2 Blue Teams (2 Enclaves).

5.3.1.1 Vendor will conduct on-site or remote Red Team operations throughout the entire exercise.

5.3.1.2 Red Team will initiate all cyber injects and work with assigned Blue Teams to track incidents, validate Blue Team discovery and actions taken on each inject.

5.3.1.3 Purple Team will provide up to a 1 hour back brief and open discussion with their assigned Blue Teams to review a walkthrough of each cyber inject, and the results they saw (either mitigation and/or reporting) after completion of each vignette (day of training).

5.3.1.4 Red Team will participate in scheduled exercise After Action Review (AAR) at the completion of the exercise. Feedback from exercise AAR will be used to make changes/tweaks to following years training. Changes to the exercise will be at the discretion of the government and will be made in conjunction with the vendor to ensure technical feasibility and smooth integration into the following year’s exercise.

5.3.1.5 A full network map and vulnerability scan results will be provided to each Blue Team at the beginning of the training period.

5.3.2 Vendor will provide access to the VTE throughout the first week of the exercise for trainees to conduct VTE Familiarization, Network Validation (NETVAL), and tool familiarization.

5.3.2.1 Vendor should be available from 0800-1700 CST on all exercise days to respond to trouble tickets by Blue Teams.

(a) Trouble Tickets submitted to Vendor Support will be acknowledged within 1 hour of submission.

5.3.2.2 Vendor will provide electronic copies of all associated documentation on the Network Topology, Red Team playbooks (for White Cell only), Credentials, Vulnerability listings/reports, and Tool Access procedures for use as reference during NETVAL and Exercise.

5.3.3 Red team exercise preparation.

5.3.3.1 Red Team will use the first week of the exercise for final functions checks of injects/simulations. They will provide at least 2 inject functions checks per team to ensure team is sync’d with correct Red Team injects.

5.3.3.2 Red Team will provide status report and mission readiness confirmation the Friday before the range portion of the exercise. Mission readiness report will mainly provide results of the functions checks, and some indicators that the Red/Blue teams are ready to engage in scenario-based training.

5.3.3.3 Issues with equipment, software, or injects will be resolved by Vendor and Exercise Staff to ensure COP is functional and recording events correctly Friday before the range portion of the exercise.

5.3.4 Exercise go-live. The hours of operation and support are expected between 0800-1700 (CST). Lunch Break will occur between 1200-1300, but vendor support is expected to remain consistent through these times.

5.3.4.1 All vulnerabilities will have a classification/Risk Level (typically produced by the active vulnerability scan) that is commensurate with common vulnerabilities seen in an Enterprise IT Environment.

5.3.4.2 Vendor will focus on top common vulnerabilities that require advanced tactics as needed to ensure successful exploits by their Red Team.

5.3.4.3 Vendor will build all cyber injects (incident simulations). They will support injects that are conducive to realistic threats of malware, social engineering, and other methods as dictated by the exercise director.

5.3.4.4 Cyber injects will be grouped based on the different types of scenarios (vignettes) that will be coordinated by the White Cell and VTE director. Vendor will assist with the development of scenarios and their integration between injects and other simulations.

5.3.4.5 Red Team will run execution of injects upon command of White Cell and/or as scripted. Purple teams will have knowledge of the attacks being conducted and observing teams’ responses, providing feedback and assistance as needed to ensure that training is effective. Vendor will provide at least one Red Team member for two enclaves.

5.4 Exercise Support: Training & Operations

5.4.1 Vendor will provide at least one Purple Team member for two enclaves.

5.4.1.1 Vendor’s Purple Team will provide a hotwash of the play by play of Red Team events and provide feedback on Blue Team’s successful or unsuccessful responses to incidents. The feedback of actions to take or improve should map to NIST CSF to assist Blue Teams in improving applicable areas of incident response. The briefing will be conducted with the entire group via video teleconference medium (TBD).

5.4.2 Red Team will provide an exercise AAR to the government no later than 30 days after the conclusion of the exercise. AAR will focus on areas of sustainment and improvement for execution of the exercise from the vendors standpoint. This AAR will be used in conjunction with the whole exercise AAR conducted on the last day of the exercise to make changes/tweaks to subsequent exercises throughout the duration of the contract.

Attachment 1 – Performance Requirements Summary

Quality Level

Attachment 2 – Deliverables