A02 Security Onion PWS UPDATE 1.docx

PERFORMANCE WORK STATEMENT

FOR

ADVANCED CYBER EXPERTISE TRAINING

FOR THE

U.S. ARMY CYBER PROTECTION BRIGADE

FORT EISENHOWER, GA 30905

1.0

INTRODUCTION.

1.1 General. This is a supply contract to provide advanced individual cyber training, low density subject matter expertise enhancement, and certifications. The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.2 Description of Services/Introduction. The contractor shall provide all exam vouchers, personnel, equipment, supplies, tools, materials, and other items and non-personal services necessary to provide instruction and support services in a classroom environment as defined in this Performance Work Statement, except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.3 Background. The United States Army Cyber Protection Brigade (USACPB) requires contractor training support for Defensive Cyber Operations instruction for developing specific and critical skill sets for enhancement of operational capability in direct support of the United States Cyber Command (USCC) Cyber Mission Force (CMF) employment of forces.

1.4 Objectives. Provide high-quality management, exam vouchers, and instructors for advanced individual cyber training in forensics, industrial control systems, management, and security for the USACPB.

2.0 SCOPE.

2.1 The advanced training pipeline is designed to provide hands-on training of high-quality industry content and curriculum to USACPB personnel. The training shall provide advanced technical cyber security expertise and knowledge not readily available in the U.S. Army training inventory. The program will ultimately prepare Government personnel, and emerging cyber-force specialty areas, with the knowledge and expertise to utilize various tools to defend, monitor, detect, analyze, audit, and mitigate threats to Department of Defense (DoD) and United States Army networks. Training and education shall focus on defending tactical thru strategic networks, wired and wireless telecommunications systems, and networks (enterprise-wide) at all levels of the Global Information Grid (terrestrial, air, and satellite) in support of United States Army, Joint, Combined, and Coalition operations worldwide.

The contractor shall provide, maintain, and make available instructors capable of providing the services specified in this Performance Work Statement (PWS). The contractor shall provide and maintain current curriculum and develop new curriculum; perform planning, research and development, technical analysis, and administration; develop course material, syllabi, and software package/images used to perform labs or practical exams; conduct classroom and lab instruction and maintenance; develop and grade homework assignments, tests, and labs; provide blended training solutions, labs, assessment, or self-study products; provide all subject texts and textbooks for the requisite course; develop and employ advanced distributed learning; as directed by the Contracting Officer’s Representative (GOVERNMENT TECHNICAL MONITOR). This task is required to support the United States Cyber Command (USCC) Cyber Mission Force (CMF) training and certification requirements for the employment of Cyber Protection Teams (CPTs).

3.0 PERIOD OF PERFORMANCE. The Period of Performance (POP) shall be defined as a 12 month period from 30 September 2024 through 29 September 2025 with no option periods.

4.0 GENERAL.

4.1 Applicable Documents. The Government, for use in accomplishing specified tasks, will supply supporting documentation required to accomplish specific requirements and products described in this PWS. The contractor shall perform tasks IAW applicable Government regulations and in compliance with listed Army Regulations (AR), Department of the Army Pamphlets (DA PAM), and technical publications, outlined in Appendix A: References. References. Appendix B: Acronyms, is provided for reference.

4.2 Federal Government Holidays.

Juneteenth

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday. Holidays falling on a Sunday will be observed on the following Monday. In addition to the days designated as holidays, the Government any other day designated by Federal Statute, Executive Order or Presidential Proclamation.

4.3 Hours of Operation. The contractor is responsible for conducting business, between the hours of 8 A.M. to 5 P.M. Monday thru Friday, except when the Government facility is closed due to Federal Holidays, emergencies, administrative closings, or similar Government directed facility closings. The work schedule may vary based on training requirements and course length, e.g., Monday thru Saturday for a six (6) day class. The Contractor must at all times maintain an adequate workforce for facilitation of training defined within this PWS when the Government facility is not closed for the above reasons.

4.4 Place of Performance: The Place of Performance for Advance Individual Cyber Training is: 3150 Perimeter Parkway Augusta, GA 30906.

4.5 Type of Contract: The Government will award a Firm-Fixed Price Contract.

5.0 REQUIREMENTS AND PERFORMANCE STANDARDS.

5.1 All personnel employed by the contractor to present curriculum shall:

5.1.1 Meet and adhere to security requirements and procedures,

5.1.2 Maintain classroom presentation, equipment and furniture, and

5.1.3 Administer and enforce test control standards.

5.2 Provide student material that can be used as a reference. This material shall be updated quarterly or semi-annually so as to in Government Technical Monitor prorate current-threat technology and not become obsolete.

5.3 Provide two (2) separate classes of Security Onion 2 Detection Engineering and Analysis In-Depth to FORT EISENHOWER, GA. The GOVERNMENT TECHNICAL MONITOR will coordinate and schedule classes with the contractor.

5.4 Provide all classroom training materials such as student handouts, lesson plans, slides, and practical exercises.

5.5 The Government reserves the right to convert any of the scheduled two (2) separate classes to virtual / CyberCast courses in the event of facility unavailability or extenuating circumstances.

5.6 Perform relevant instructor duties including installation, configuration, and maintenance on any contractor-provided software or hardware. The Government reserves the right to request a specific instructor for training.

5.7 Curriculum presentation:

5.7.1 Curriculum presentation dates will be provided by the government upon contract award.

5.7.2 All curriculum presentations will be conducted on-site at a government facility.

5.7.3 Course schedule, sequence, and titles may be changed by the GOVERNMENT TECHNICAL MONITOR. The GOVERNMENT TECHNICAL MONITOR will provide modifications of course schedule no later than 30 days prior to planned execution of said course.

5.7.4 The contractor shall be responsible for adhering to the course schedule and coordinating any requirements to obtain installation/facility clearance, obtaining approval for visitors entering required training facilities on FORT EISENHOWER, and review of visitor presentation materials due to the various media platforms used to deliver the curriculum.

5.8 Maintain and report student attendance, Government Technical Monitor, and statistics. Evaluate students and report academic concerns to the GOVERNMENT TECHNICAL MONITOR when warranted by classroom performance, e.g., academic test failure, unexcused/excessive absences, etc.

5.9 The contractor shall maintain a copy of all training/certification Government Technical Monitor for individuals attending training for a minimum of two years from the last day of training conducted executed under this contract.

6.0 PERSONNEL QUALIFICATION.

Delivery of on-site curriculum presentation instructors shall:

0. Possess a certification Government Technical Monitor responding to the material being presented.

0. Be certified as an instructor by a nationally-recognized organization;

0. Possess, at a minimum, ten (10) years of direct career field experience, all taking place within the preceding fifteen (15) years;

0. Have the capability to read, write, speak and understand English;

0. Have previous experience in designated job area or specialty.

7.0 CONTRACTOR QUALITY CONTROL PLAN (QCP).

7.1 The contractor shall establish and maintain procedures for a Quality Control Plan to ensure that the requirements of the contract are provided as specified. The plan shall describe the methods for identifying and preventing defects before the level of performance becomes unacceptable. The QCP shall address processes for Government Technical Monitor reactive actions without dependence upon the Government direction. The basic tenet of the plan is that the contractor is responsible for quality of service they provide. All methods, procedures, forms, shall support this concept. The contractor shall develop and submit a QCP for Government approval. The Quality Control Plan shall include activities to improve support processes, technical approach, and should describe how the contractor will improve customer service over the life of order delivery.

7.2 Revisions. Revisions to the Quality Control Plan may be required at any time during performance of the contract to assure contractor compliance with requirements of the PWS and contract. The contractor shall make appropriate revisions and obtain acceptance of the revised plan from the GOVERNMENT TECHNICAL MONITOR.

8.0 DELIVERABLES.

8.1 Monthly Progress Reports (MPR) (CDRL A001). The contractor shall provide a monthly Contractor’s Progress, Status, and Management Report. The report must be submitted to the GOVERNMENT TECHNICAL MONITOR no later than the 15th of every month. The report must accompany a copy of that month’s WAWF invoice. The MPR’s shall be compiled, reviewed, and submitted with a cover letter, which summarizes the activities and significant events occurring during the preceding month. The MPR shall include, but shall not be limited to:

a) Brief description of the requirements

b) Brief summary of accomplishments during the reporting period.

c) 3-month consolidated course(s) schedule (projected).

d) Significant events or activities regarding the contract.

e) Progress on deliverable products.

f) Current or anticipated problem areas.

g) Summary of activities planned for the next reporting period.

8.2 Training Government Technical Monitor (CDRL A002). The contractor shall provide certificates of training to students following the successful completion of class. In addition to the contractor maintaining a copy of all training/certification Government Technical Monitor of individuals attending training for a minimum of two years from the last day of training conducted executed under this contract, the contractor will provide a soft (digital) copy of certificates to the GOVERNMENT TECHNICAL MONITOR NLT one (1) week following the completion of each class.

8.3 Quality Control Plan (CDRL A003). The contractor shall provide a Quality Control Plan (QCP) upon the Government’s request. Initially the QCP should be delivered to the Government within two (2) weeks after the contract start date. Revisions should be submitted for Government approval as the contractor makes adjustments to the QCP.

8.4 End of Course Feedback (CDRL A004). The contractor shall provide end of course feedback to students of each class. Following the each class, no later than one (1) week after the completion of a class, the contractor will provide all student feedback to the Contracting Officer’s Representative (GOVERNMENT TECHNICAL MONITOR).

9.0 FACILITIES SUPPLIES AND SERVICES.

The Government will provide the necessary workspace for the contractor staff to provide required support to include classroom, desk space, chairs, computers, and other items conducive to a training facility at the place of performance. The Government’s property shall be used only in performance of this task, unless otherwise provided in this contract and unless otherwise approved by the contracting officer.

10.0 TEXTBOOKS/ SUPPLIES/MATERIALS/HARDWARE/SOFTWARE/LICENSING.

The contractor shall provide text books, hardware, software, licensing, shipping, printed materials, testing products, media resources, lab packages, and other courseware products, as required for each instructed course. Additionally, the contractor will provide a copy of the training material (digital and/or printed) to students that can be used for reference after the conclusion of training.

11.0 INVOICING.

11.1 Wide Area Workflow (WAWF) shall be implemented in Government Technical Monitor accordance dance with DFAR 252.232-7003 Electronic Submission of Payment Requests. Manual invoices will not be accepted.

11.2 Format. All invoices shall be submitted in WAWF as a 2-in-1 invoice with all applicable monthly documentation attached. Monthly documentation includes Monthly Status Reports (MSR), In- Progress Reviews (IPR) and other reports where applicable as stated in the PWS. Monthly documentation may not be submitted via email. Invoices submitted as anything other than a 2-in-1 and/or without attached monthly documentation will be rejected.

11.3 Routing. Invoices shall be routed to the GOVERNMENT TECHNICAL MONITOR as “inspector” as well as the S8/Resource Management officer as “acceptor”. When preparing an invoice, both the “inspector” and “acceptor” fields shall be completed with the DODAAC “W58TSU”. This same DODAAC shall be used in both the “inspector” and “acceptor” field.

11.4 Email notification of invoice submission shall be sent to the GOVERNMENT TECHNICAL MONITOR and appropriate S8/Resource Management representative. This email shall be initiated through the WAWF system by clicking on the "send more email notifications” link. This link is found at the bottom of the "submitted successfully" page after the invoice is submitted into the system. Email notifications, other than those initiated through WAWF, will not meet proper routing requirements and will not be accepted. If email notifications are not properly sent to appropriate individuals through WAWF, the invoice will be rejected.

11.5 A contract employee with the authority to bind the company contractually shall certify all invoices. Invoices shall be submitted no later than (NLT) ten days after the end of each month (30-day period), depending on the contract award date. Failure to submit invoices in a timely manner is a direct violation of this contract agreement. The Government shall have the right to exercise a penalty cost, due to the contractor being out of compliance of this contract agreement.

11.6 The invoice submitted at the end of the period of performance shall state “final invoice.” This annotation shall be accomplished in Wide Area Workflow Invoice 2-in-1 section, under Tab Misc. Info, and in the area of Initiator Information Comments.

12.0 ADMINISTRATIVE CONSIDERATIONS.

12.1 Work Schedule. The projected instruction hours are from 0800-1700 during the training period. However, these operating hours and days may vary based on the requirements of the Government. Only the Contracting Officer can give explicit written approval of overtime. Overtime pay is not authorized.

12.2 Dress/Appearance. Contractor personnel shall present a clean and neat appearance. Contractor personnel shall not permit shorts and clothing with tears, revealing clothing, clothing with obscene or inflammatory designs, slogans, or remarks, or clothing representing military attire such as the Army Combat Uniform. Attire should be equivalent to casual dress.

13.0 SECURITY.

13.1 Contractor employees performing on this contract/task order must be a U.S. citizen. Contractor employees, to include subcontractors, requiring access to information systems to fulfill their duties must possess the required favorable security investigation. Contractor employees that require access to the FORT EISENHOWER network shall have a minimum of a National Agency Check with Inquiries (NACI) investigation initiated and favorable review before issuance of network access. The IASO/IANO from the activity that the contractor employee is assigned to, will submit an electronic DD 2875, System Authorization Access Request (SAAR) to Security & Intelligence Division for verification that the contractor employee meets the requirements of AR 25-2 for accessing the FORT EISENHOWER network. (Ref AR 25-2)

13.2 Anti-Terrorism (AT) Level I Training. All contractor employees, including subcontractors, assigned to this contract shall receive an initial Antiterrorism Level I Brief by a certified ATO Level II Officer within 30 days of reporting for duty. (Monthly briefings will be offered by the Garrison Antiterrorism Officer.) Annual refresher Antiterrorism Level I Training shall be completed on-line at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf or they may attend the monthly training offered by the Garrison ATO. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the GOVERNMENT TECHNICAL MONITOR and unit/activity security manager. (Ref Department of the Army, US Army Contracting Agency, SFCA-CO, 5 Sep 07, subject: Government Technical Monitor portion of Measures into the Contracting Process and AR 525-13, Antiterrorism).

13.3 Access and General Protection/Security Policy and Procedures. This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, HQDA, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

13.4 iWATCH. All contractor employees, including subcontractors, assigned to this contract shall receive a brief on the local iWATCH program (provided in conjunction with the AT Level I Training). This training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the GOVERNMENT TECHNICAL MONITOR. This training shall be completed within 30 days of reporting to duty and annual refresher training with the results reported to the GOVERNMENT TECHNICAL MONITOR.

13.5 Installation Access. All contractor employees, including subcontractors, shall comply with applicable installation and facility access security policies and procedures at all work and TDY locations. The FORT EISENHOWER military installation is a limited access post. Unscheduled gate closures by the military police may occur at any time. In Government Technical Monitor in accordance with Army Regulation 525-13, paragraph 5-19, all prospective contractors will undergo a verification process by the installation Provost marshal Office, Director of Emergency Services to determine the trustworthiness and suitability prior to being granted access to federal property. This will be accomplished using the National Crime Information Center (NCIC) Interstate Identification Index (III). This is the minimum baseline background check for entrance onto Army Installations for non-CAC holders to include entrance of visitors (Ref AR 190-13, paragraph 8-2). All personnel entering or exiting the installation may experience a delay due to vehicle inspections, registration checks, verification of seat belt use, etc. All vehicles and personnel are subject to search and seizure. The search and seizure provisions shall apply to contractor personnel while within FORT EISENHOWER's area of jurisdiction. Contractor personnel shall comply with all entry control requirements and security policies/procedures in effect. Security procedures may change without notice.

13.6 Identification of Contractor Employees. In Government Technical Monitor accordance with FAR 37.114 contractor employees shall identify themselves as a contractor at all times while on the job, e.g., in the workplace, when attending meetings, in email, when answering government telephones, or when making phone calls.

13.7 ID Badges. The contractor shall provide each contractor employee an identification (ID) badge on contract start date or on employment start date. The ID badge shall be made of nonmetallic material, be easily readable, and shall contain the following minimum information: Employee’s Name, Contract Company Name and Employee’s Photograph. Contract employees shall wear proper identification at Government workplaces at all times. Contractor employees shall wear the ID badge in a conspicuous place (i.e., above the waist and on front of exterior clothes) at all times when performing work under this contract.

13.8 Using Electronic Mail. When contractor employees send e-mail messages to government personnel while performing on this contract, the contractor employee’s e-mail address shall include the company name together with the person’s name (ex: John Smith, Contractor, ABC Company).

13.9 Eligibility Verification for Employment. E-Verify is an Internet-based system that compares information from an employee's Form I-9, Employment Eligibility Verification, to data from U.S. Department of Homeland Security and Social Security Administration Government Technical Monitor to confirm employment eligibility. The U.S. Department of Homeland Security is working to stop unauthorized employment. By using E-Verify to determine the employment eligibility of their employees, companies become part of the solution in addressing this problem. All U.S. employers must complete and retain a Form I-9 for each individual they hire for employment in the United States. This includes citizens and noncitizens. On the form, the employer must examine the employment eligibility and identity document(s) an employee presents to determine whether the document(s) reasonably appear to be genuine and relate to the individual and Government Technical Monitor the document information on the Form I-9. The list of acceptable documents can be found on the last page of the form. E-Verify is mandatory for employers with federal contracts or subcontracts that contain the Federal Acquisition Regulation E-Verify clause.

14.0 DELIVERY PROVISIONS. Direct all Government Technical Monitor respondence to United States Army Cyber Protection Brigade (USACPB), FORT EISENHOWER, GA 30905.

15.0 CONTRACTING OFFICER’S REPRESENTATIVE (GOVERNMENT TECHNICAL MONITOR).

15.1 The GOVERNMENT TECHNICAL MONITOR will be identified by separate letter. The GOVERNMENT TECHNICAL MONITOR monitors all technical aspects of the contract and assists in contract administration. The GOVERNMENT TECHNICAL MONITOR is authorized to perform the following functions:

a) Assure that the Contractor performs the technical requirements of the contract.

b) Perform inspections necessary in connection with contract performance.

c) Maintain written and oral communications with the Contractor concerning technical aspects of the contract.

d) Issue written interpretations of technical requirements, including Government drawings, designs, and specifications.

e) Monitor Contractor’s performance and notifies both the Contracting Officer and Contractor of any deficiencies.

f) Coordinate availability of Government furnished property.

g) Provide site entry of Contractor personnel.

15.2 GOVERNMENT TECHNICAL MONITOR Letter. A letter of designation issued to the GOVERNMENT TECHNICAL MONITOR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the GOVERNMENT TECHNICAL MONITOR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The GOVERNMENT TECHNICAL MONITOR is not authorized to change any of the terms and conditions of the resulting order.

16.0 ATTACHMENTS / TECHNICAL EXHIBIT LIST.

16.1 Performance Requirement Summary (PRS): The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to the mission success.

Documents must be free of error 95% of the time.

17.0 APPLICABLE DOCUMENTS.

17.1 The Contractor (to include Sub-Contractor) must abide by all applicable regulations, publications, manuals, and local policies and procedures. The Government, for use in accomplishing specified tasks, will supply supporting documentation required to accomplish specific requirements and products described in this Performance Work Statement (PWS).

17.2 The contractor will perform tasks IAW applicable Government regulations and in compliance with the listed Army Regulations (AR), Field Manuel (FM) and technical publications. Applicable documentation may include, but not limited to the following:

· AR 350-1, Army Training; http://www.apd.army.mil/series_range_pubs.asp?range=350

· AR 25-2, Information Assurance.

· AR 380-5, Department of the Army Information Security Program

· AR 530-1, Operations Security

· AR 380-53, dated April 1998, Information Systems Security Monitoring

· CJCSI 6510.01E, dated August 2007, Information Assurance (IA) and Computer Network Defense (CND)

· CJCSM 6510.01A, dated June 2009, Information Assurance (IA) And Computer Network Defense (CND) - Volume I (Incident Handling Program)

· DOD Directive 5105.21-M-1, dated August 1998, Department of Defense Sensitive Compartmented Information Administrative Security Manual

· DOD 5200.2-R, Personnel Security Program

· DODD 8530-1, dated January 2001, Computer Network Defense (CND) Directive

· DOD 8530.1-M, dated December 2003, CND Service Provider Certification and Accreditation Process Program Manual.

· TRADOC Pamphlet 350-70-12, dated 29 March 2004, Distributed Learning - Managing Courseware Production and Implementation

· TRADOC Pamphlet 525-7-8, dated 22 February 2010, The United States Army's Cyberspace Operations Concept Capability Plan 2016-2028.

· USASC&FG 350-5 (Ft Gordon Academic Practices)

· USASC&FG 350-22 (Test Control Policies and Procedures)

· IA Training Best Business Practices, dated30 Nov 2009; https://atc.us.army.mil/iastar/regulations.php Applicable DOD, Joint, Army, TRADOC, and USASC&FG regulations, policies, SOPs, and guidance located at the DISA's IA one-stop-shop: http://iase.disa.mil/policy-guidance/index.html.

18.0 ACRONYMS:

END OF PWS