ACIT JA Redacted.pdf

Control No.: MICC 2026-25

Justification Review Document FAR Part 6 Justification and Approval for Other than Full and Open Competition

Program/Equipment: The U.S. Army Cyber School (USACyS) has a recurring requirement to procure SANS Innovation Center’s Global Information Assurance Certification (GIAC) prep course curriculum and certification to establish, administer, and execute the Advanced Cyber Industry Training Service Contract.

Authority: 10 U.S.C 3204(a)(1) as implemented by FAR Part 6.103-1 – Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements.

Amount:

Prepared by:

Contracting Officer:

Technical:

Requirements:

Control No: MICC 2026-25

FAR Part 6 Justification and Approval for Other than Full and Open Competition

1. Requiring Activity: U.S. Army Cyber School (USACyS), Fort Gordon, GA 30905

2. Contracting Activity: U.S. Army Mission and Installation Contracting Command (MICC)-Fort Gordon, 271 Heritage Park Lane, Bldg. 35200, Fort Gordon, GA 30905.

3. Description of Action: Request approval of a firm-fixed-price contract with SANS Innovation Center, located at 11200 Rockville Pike, Suite 200 North Bethesda, MD 20852, for the listed Global Information Assurance Certification (GIAC) certifications and SANS prep course curriculum. The Government projects award for February 2026 and Fiscal Year 2026 Operations and Maintenance, Army (OMA) funds will be used.

4. Description of Supplies/Services: During each 12-month contract performance period, the SANS Innovation Center will provide three iterations of the Advanced Cyber Operation-Academics (ACO-A) functional course. Each offering of the ACO-A will be comprised of eight SANS courses (SEC560, SEC542, SEC580, SEC565, SEC599, SEC660, FOR508, and SEC699), six GIACs (GPEN, GWAPT, GDAT, GCFA, GXPN, and GRTP), and two practice tests for each GIAC. During each 12-month contract performance period, SANS Innovation Center will also provide two (2) iterations each of the 170A Cyber Operations Technician WOAC course and the 170A Cyber Warfare Technician WOIC course with a curriculum consisting of SEC588, FOR508 and FOR572, as well as GIAC certifications in GCFA, GNFA and GCFR with two practice tests for each certification.

If FAR Clause 52.217-8 is executed for an additional 6 months of performance, then SANS Innovation Center will provide ten SANS courses (SEC560, SEC542, SEC580, SEC565, SEC599, SEC588, SEC660, FOR508, FOR572, SEC699), eight GIACs (GPEN, GWAPT, GDAT, GCFA, GXPN, GNFA, GCFR, and GRTP), and two practice tests for each GIAC during this 6-month period.

Each SANS Course is listed below with an associated Learning Outcome (LO) / Terminal Learning Objective (TLO). The Enabling Learning Objectives (ELOs) that support activities associated with each LO/TLO are marked with bullets.

a. Course: SEC 560 - Enterprise Penetration Testing Certification: GIAC Penetration Tester (GPEN) Learning Outcome/TLO: Learn how to plan, prepare, and execute a penetration test in a modern enterprise.

Perform detailed reconnaissance to aid in social engineering, phishing, and making well-informed attack decisions Scan target networks using best-of-breed tools to identify systems and targets that other tools and techniques may have missed

Fuzz potential inputs for injection attacks with ZAP, BurP'S Intruder and FFuF Explain the impact of exploitation of web application flaws Analyze traffic between the client and the server application using tools such as the Zed Attack Proxy and BurpSuite Pro to find security issues within the client-side application code Manually discover and exploit Cross-Site Request Forgery (CSRF) attacks Manually discover and exploit Server-Side Request Forgery (SSRF) attacks Use the Browser Exploitation Framework (BeEF) to hook victim browsers, attack client software and the network, and evaluate the potential impact that XSS flaws have within an application Use the Nuclei tool to perform scans of target web sites/servers Perform two complete web penetration tests, one during the five sections of course instruction, and the other during the Capture the Flag exercise

c. Course: SEC 580 - Metasploit for Enterprise Penetration Testing Certification: None Learning Outcome/TLO: Learn how to apply the capabilities of the Metasploit Framework in a comprehensive penetration testing and vulnerability assessment regimen, and according to a thorough methodology for performing effective tests.

Guided Overview of Metasploit's Architecture and Components Deep Dive into the Msfconsole Interface, including Logging and Session

Manipulation Careful and Effective Exploitation The Ultimate Payload: The Metasploit Meterpreter In-Depth Metasploit's Integration into a Professional Testing Methodology Automation with Meterpreter Scripts to Achieve More in Less Time with

Consistency Using Metasploit as a Recon Tool Using Auxiliary Modules to Enhance your Testing Ultra-Stealthy Techniques for Bypassing Anti-Virus Tools Client-Side Attacks - Using One-Liners instead of Executables Port and Vulnerability Scanning with Metasploit, Including Integration with

Nmap, Nessus, and Qualys Capturing SMB Credentials and Metasploit's awesome PowerShell integration Merciless Pivoting: Routing Through Exploited Systems Exposing Metasploit's Routing Using SOCKS Proxies Privilege Escalation Attacks Metasploit's Integration with Other Tools

Making the Most of Windows Payloads Advanced Pillaging - Gathering Useful Data from Compromised Machines Evading Countermeasures to Mimic Sophisticated Attackers Scripting Up the Meterpreter to Customize Your Own Attacks Persisting Inside an Environment Carefully Examining Your Attack's Forensic Artifacts Integration with CrackMapExec, a Stand-alone Testing Tool Command and Control via Third-Party Infrastructure

d. Course: SEC 565 - Red Team Operations and Adversary Emulation Certification: GIAC Red Team Professional Certification (GRTP) Learning Outcome/TLO: Learn how to plan and execute end-to-end Red Teaming engagements that leverage adversary emulation, including the skills to organize a Red Team, consume threat intelligence to map against adversary tactics, techniques, and procedures (TTPs), emulate those TTPs, report and analyze the results of the Red Team engagement, and ultimately improve the overall security posture of the organization.

Use threat intelligence to study adversaries for emulation Build an adversary emulation plan Map actions to MITRE® ATT&CK™ to aid in communicating with the Blue

Team Establish resilient, advanced C2 infrastructure Maintain operational security throughout an engagement Leverage initial access to elevate and propagate through a network Enumerate and attack Active Directory Collect and exfiltrate sensitive data in a safe manner Close an engagement, deliver value, and plan for retesting

e. Course: SEC 599 - Defeating Advanced Adversaries-Purple Team Tactics & Kill Chain Defenses Certification: GIAC Defending Advanced Threats (GDAT) Learning Outcome/TLO: Learn security controls aimed at stopping, detecting, and responding to your adversaries through a purple team strategy.

Leveraging MITRE ATT&CK as a "common language" in the organization Building your own Cuckoo sandbox solution to analyze payloads Developing effective group policies to improve script execution (including

PowerShell, Windows Script Host, VBA, HTA, etc.)

Highlighting key bypass strategies for script controls (Unmanaged

Powershell, AMSI bypasses, etc.)

Stopping 0-day exploits using ExploitGuard and application whitelisting Highlighting key bypass strategies in application whitelisting (focus on

AppLocker) Detecting and preventing malware persistence Leveraging the Elastic stack as a central log analysis solution Detecting and preventing lateral movement through Sysmon, Windows event monitoring, and group policies Blocking and detecting command and control through network traffic analysis Leveraging threat intelligence to improve your security posture

f. Course: SEC 660 - Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Certification: GIAC Exploit Researcher and Advanced Penetration Tester (GXPN) Learning Outcome/TLO: Learn how to model the abilities of an advanced attacker to find significant flaws in a target environment and demonstrate the business risk associated with these flaws.

Perform fuzz testing to enhance your company's SDL process Exploit network devices and assess network application protocols Escape from restricted environments on Linux and Windows Test cryptographic implementations Model the techniques used by attackers to perform 0-day vulnerability discovery and exploit development Develop more accurate quantitative and qualitative risk assessments through validation Demonstrate the needs and effects of leveraging modern exploit mitigation controls Reverse-engineer vulnerable code to write custom exploits Exploit routing protocol implementations such as OSPF Bypass different types of NAC implementations Exploit patch updates Perform man-in-the-middle attacks to remove SSL Perform IPv6 attacks Exploit poor cryptographic implementations using CBC bit flipping attacks and hash length extension attacks Hijack network booting environments Exploit virtualization implementations

Write Python scripts to automate testing Write fuzzers to trigger bugs in software Reverse-engineer applications to locate code paths and identify potential exploitable bugs Debug Linux applications Debug Windows applications Write exploits against buffer overflow vulnerabilities Bypass exploit mitigations such as ASLR, DEP, stack canaries, SafeSEH, etc Use ROP to bypass or disable security controls

g. Course: FOR 508 - Advanced Incident Response, Threat Hunting, and Digital

Forensics Certification: GIAC Certified Forensic Analyst (GCFA) Learning Outcome/TLO: Learn advanced skills to hunt, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivists.

Understand attacker tradecraft to perform compromise assessments Detect how and when a breach occurred Quickly identify compromised and infected systems Perform damage assessments and determine what was read, stolen, or changed Contain and remediate incidents of all types Track adversaries and develop threat intelligence to scope a network Hunt down additional breaches using knowledge of adversary techniques Learn and master the tools, techniques, and procedures necessary to effectively hunt, detect, and contain a variety of adversaries and remediate incidents Detect and hunt unknown live, dormant, and custom malware in memory across multiple Windows systems in an enterprise environment Hunt through and perform incident response across hundreds of unique systems simultaneously using PowerShell, Velociraptor, and the SIFT Workstation Identify and track malware beaconing outbound to its command and control

(C2) channel via memory forensics, registry analysis, and network connection residue Determine how the breach occurred by identifying the root cause, the beachhead systems and initial attack mechanisms

Identify living off the land techniques, including malicious use of PowerShell and WMI Target advanced adversary anti-forensics techniques like hidden and time-stomped malware, along with living off the land techniques used to move in the network and maintain an attacker's presence Use memory analysis, incident response, and threat hunting tools in the SIFT

Workstation to detect hidden processes, malware, attacker command lines, rootkits, network connections, and more Track user and attacker activity second-by-second on the system you are analyzing through in-depth timeline and super-timeline analysis Recover data cleared using anti-forensics techniques via Volume Shadow

Copy/Restore Point analysis Identify lateral movement and pivots within your enterprise across your endpoints, showing how attackers transition from system to system without detection Understand how the attacker can acquire legitimate credentials - including domain administrator rights - even in a locked-down environment Track data movement as attackers collect critical data and shift it to exfiltration collection points Recover data cleared using anti-forensics techniques via Volume Shadow

Copy and Restore Point analysis and artifact carving Use collected data to perform effective remediation across the entire enterprise Build advanced forensics skills to counter anti-forensics and data hiding from technical subjects

h. Course: SEC 699 - Purple Team Tactics-Adversary Emulation for Breach Prevention & Detection Certification: None Learning Outcome/TLO: Learn how adversarial techniques can be emulated and detected.

A course section on typical automation strategies such as Ansible, Docker and Terraform. These can be used to deploy a full multi-domain enterprise environment for adversary emulation at the press of a button Building a proper process, tooling, and planning for purple teaming Building adversary emulation plans that mimic real-life threat actors such as

APT-28, APT-34, and Turla to execute these plans using tools such as Covenant and Caldera

GCFA, GXPEN, and GRTP), and two practice tests for each GIAC. SANS Innovation Center is the sole provider of SANS training and GIAC certifications. There are no agents or dealers authorized to represent themselves as resellers of SANS products.

b. Alternatives.

1) Provide other enhanced training: This will not be a viable solution because the USACyS does not have any other courses of training within the schoolhouse that meets the specific technical training that the USCYBERCOM requires for their personnel.

2) Use in-house personnel/expertise: The USACyS does not have the instructors that possess the specific technical expertise to provide the level of cyber training needed by the USCYBERCOM personnel.

3) Suspend operations: The USACyS cannot suspend the operations due to the impact of the overall mission that pertains to operations and readiness to meet the requirements set forth by the USCYBERCOM Commander.

c. Impact if justification is not approved: The USACyS will not be able to support the execution of the ACO-A Functional Course and meet the mandated requirement set forth by USCYBERCOM to establish, administer, and execute an Advanced Cyber Operations-Academics (ACO-A) Functional Course.

7. Efforts to Obtain Competition: The Contracting Officer shall publish the notices required by FAR 5.201. Accordingly, a sources sought notice was posted to SAM.GOV by MICC-Fort Gordon on 12 January 2026. The sources sought notice included a statement of salient characteristics, and detailed specifications of the requirement. The capability statement provided by SANS was the only vendor deemed technically capable by the requiring activity upon review. Market research consisted of internet research of vendors’ websites, literature reviews, other professional resources and industry events.

As implemented by FAR 19.109(c), the contracting officer must determine whether subcontracting possibilities exist. It has been determined that there are no subcontracting possibilities, and the determination with a detailed rationale, has been approved at a level above the contracting officer, and placed in the contract file.

8. Actions to Increase Competition: No other competition is available. SANS Innovation Center is the sole provider of SANS training and Global Information Assurance Certification (“GIACs"). A sole source letter was provided by SANS stating they have the exclusive right to produce official SANS Curriculum and deliver SANS training through SANS Certified Instructors. USACyS continually researches sources of information to determine the availability of other providers of GIAC certifications in a package along with commercially available training that could potentially meet the Government’s need in the open market.

11. Other Facts:

a. This is a recurring requirement to establish, administer, and execute the Advanced Cyber Operations-Academics (ACO-A) Functional Course. The previous effort was a sole source award to SANS Innovation Center.

Contract number: W91249-25-C-A004 Vendor: SANS Innovation Center Award date: 14 January 2025 Competitive Status: Sole Source Authority cited: Simplified Procedures for Certain Commercial Items, Title 41 U.S.C. 1901 as implemented by FAR 13.5. Exclusive Licensing agreements.

Contract number: W91249-24-C-0012 Vendor: SANS Innovation Center Award date: 18 July 2024 Competitive Status: Sole Source Authority cited: Simplified Procedures for Certain Commercial Items, Title 41 U.S.C. 1901 as implemented by FAR 13.5. Exclusive Licensing agreements.

b. There are no current services available at the USACyS to execute the

USCYBERCOM requirements.

c. The specific need to use SANS Innovation Center, LLC was the explicit requirement from USCYBERCOM that training be conducted via in-person modularity for the following courses: SEC560, SEC542, SEC580, FOR508, SEC660, SEC699, SEC599, SEC565. After extensive market research conducted by USCYBERCOM, it was confirmed that these courses are only offered by SANS LLC. The mandate to establish, administer, and execute an Advanced Cyber Operations-Academics (ACO-A) Functional Course was communicated from USCYBERCOM J-7 via signed course growth sponsorship memorandum.

Approval

Based on the foregoing justification, I hereby approve the procurement of cyber training and certifications from the SANS Innovation Center on an other than full and open competition basis pursuant to the authority of Title 10 United States Code Section 3204(a)(1) as implemented in Federal Acquisition Regulation 6.103-1(c)(2)(i) - Only One Responsible Source and No Other Supplies or Services Will Satisfy Agency Requirements. The estimated value of the contract is $15.9 million for approximately a 3-year period of performance consisting of an eleven-month base year and two option years from approximately 24 February 2026 to 20 January 2029, to include FAR Clause 52.217-8 for an additional 6 months if exercised. The approval is subject to availability of funds, and provided that the supplies herein described have otherwise been authorized for acquisition.

Alternate Advocate for Competition U.S. Army Mission and Installation Contracting Command, JBSA Fort Sam Houston, TX