AE-ITT II PWS - USAREUR Draft.pdf

PERFORMANCE WORK STATEMENT (PWS)

Army Europe Information Technology Training (AE-ITT) Program USAREUR-AF G6

Part 1

General Information

1. Introduction: This is a non-personnel services contract to provide U.S. Army Europe -

Information Technology Training (AE-ITT) Program with Virtual Cybersecurity (CS) and

Information Technology (IT) training and certification services.

1.1 Background: In 1999 the US Army Europe and Africa (USAREUR-AF G6) established the AE-ITT Program to provide cost-effective, theater-wide CS and IT training under the Title 10 responsibilities for USAREUR-AF G6 in their Army Service Component Command

(ASCC) role to be the executive agency for US Code Title 10 basic services relating to theater communication infrastructure (Network, Telephone, Satellite), and the safeguarding of these services. Additionally in 2016, the USAREUR-AF G6 was designated as the Designated

Authorizing Official (AO) to assume responsibility for operating systems at an acceptable level of risk for the European Theater. The AE-ITT program facilitates the ability of the AO to assume acceptable risk for operating systems by improving the technical capability of the workforce.

The AE-ITT was primarily designed to be used by USAREUR-AF G6 and all Department of

Defense (DoD) commands/units that are geographically dispersed across the USAREUR-AF G6

Area of Responsibility (AOR). This included but was not limited to the following significant

Commands:

U.S. European Command (USEUCOM), U.S. Africa Command (USAFRICOM), Special

Operations Command Europe (SOCEUR), Network Command (NETCOM), Installation

Management Command (IMCOM), U.S. Forces in Europe (USAFE), U.S. Naval Forces

Europe (NAVEUR), U.S. Marine Corps Forces Europe (MARFOREUR), North Atlantic

Treaty Organizations (NATO) and other individual Commands, activities and tenant organizations that have a presence in the USAREUR-AF G6 AOR. The AE-ITT Program uses

Contractor personnel with appropriate subject matter expertise and certification to provide hands-on training. The training solutions enable the U.S. military to develop and maintain a skilled, competent and certified Cyber Security professional workforce. One of the primary goals of the program is to provide virtual training in the USAREUR-AF G6 AOR in order to reduce TDY travel costs. The AE-ITT Program is a force enabler for personnel to learn new skills, improve existing capabilities, enhance personal and professional development and provide access to the necessary courses and virtual certification tests which allow personnel to meet Department of the Army (AO) and Department of Defense (DoD) mandated training and certification requirements. The AE-ITT Program consists of two training areas:

A. Information Technology Training Program (ITTP): Includes commercially available, DoD-specific and Career Program (CP) 34 career developmental training courses.

B. Cybersecurity Training Program (CSTP): Includes commercially available courses and industry standard certifications that map to the Army’s Cybersecurity requirements under Department of Defense Instruction (DoDI) 8140.02, “Cyberspace Workforce Management,” and applicable U.S. Army Regulations.

Commented [C1]: Is this sentence necessary? How does it remove ambiguity regarding AFRICOM?

@Vega, Miguel A CIV USARMY USAREUR (USA)

Commented [V(2R1]: AFRICOM includes units under them, is clear that is AFRICOM as a command, I see an issue but how you want to write this up? Is like any other major command mailto:miguel.a.vega.civ@army.mil

1.2 Responsibilities: The Contractor shall perform all work and assume responsibility for planning, programming, administering, managing, marketing and executing all functions necessary to provide the services specified in this PWS. The Contractor shall conduct work in accordance with this PWS and all applicable United States (U.S.), German, and local laws, regulations, standards, provisions, and directives to include applicable publications. The

Contractor is responsible for providing an enterprise Cybersecurity and Information

Technology (CS/IT) training capability for the CS workforce within the Theater. The

Contractor must factor in the following requirements:

• All instructors must be from the United States or European or NATO countries, must be professionally proficient in the English language, and must be certified in the latest course matter being taught.

• Training services must offer a wide variety of CS/IT Workforce training courseware and subject matter in order to facilitate competency and compliance of the CS workforce.

• Training offered over the life of the contract must evolve along with industry to incorporate technology and certification changes quickly to ensure training relevancy.

• Training services must be dynamic to accommodate the Government transformational footprint in Theater to include changes in mission, assigned or co-located forces

(military and civilian) and extended mission partnerships.

• Training services must be targeted to the military community, soldiers experience and knowledge are not at the industry standard level, new methodologies may be required to ensure commercial certification is achieved.

1.2.1 Administrative Responsibility: The Contractor shall perform all related administrative actions required to provide services or perform work such as material requisitioning, quality control (QC), financial control, meetings, and correspondence. The

Contractor shall also maintain accurate and complete records, files, and libraries of documents to include all U.S. German, and local regulations, Standard Operating Procedures (SOPs), provisions, codes, laws, technical manuals, and manufacturers’ instructions and recommendations that are necessary and related to the functions being performed. The

Contractor shall compile historical data, prepare required reports, and submit information as specified by the Deliverable List presented in this PWS.

OBJECTIVES:

1.3 Functional Areas: The services in the PWS fall under the following functional areas:

• Training Services

• Virtual Testing Services Assistance

• Certification Voucher Services

• Learning Management System (LMS) Operations and Maintenance (O&M)

Support

• Custom Program of Instruction (POI)/Courseware Development

• Program Management/Administration and Course Voucher Services

Commented [C3]: Certified to teach the course or have professional IT Certification (e.g. CISM, CISSP, Securtiy+)?

@Vega, Miguel A CIV USARMY USAREUR (USA)

Commented [SGLCU4]: Keep this consistent throughout mailto:miguel.a.vega.civ@army.mil

1.4 Period of Performance: The period of performance shall be for one (1) Base Year of

12 months, and four (4) 12-month option years. The period of performance reads as follows:

• Base Year

• Option Year I

• Option Year II

• Option Year III

• Option Year IV

1.5 Management and Administration

1.5.1 Phase-In/Phase-Out Period (10 Aug – 10 Sep 2023): To minimize any decreases in productivity and to prevent possible negative impacts on training services, the Contractor shall have key personnel on board, during the 30 day Transition-In and Transition-Out phases. During this period, the Contractor shall become familiar with contractual requirements and training service delivery in order to commence full performance of the contract on the Period of

Performance start date.

1.5.2 Contractor Management: The Contractor shall perform continual management of the functional areas contained in this PWS and shall provide a certified Program Manager, Alternate Program Manager, and LMS Administrator duty location(s) Wiesbaden (Clay

Kaserne) and/or Wackernheim (McCully Barracks). The Program Manager may perform duties either virtually or physically present on-site as determined by the Government during normal duty hours. The Program Manager shall conduct overall management coordination and shall be the central point of contact (POC) with the Government for performance of all work under the

PWS. At the Post Award conference, the Contractor shall submit to the Contracting Officer

Representative (COR), in writing, the name, title, office, home and mobile telephone number of the Program Manager. An Alternate Program Manager shall be designated to act for the

Program Manager when work is being performed outside of duty hours, or during the Program

Manager’s absence. Both the Program Manager and the Alternate Program Manager filling in for the Program Manager, shall have full authority to act for the Contractor on all Contract matters relating to daily operation of this Contract.

1.5.3 Contractor Responsiveness: The Program Manager or designated alternate shall be available for telephone communication or site attendance, with the COR/PM, as required by the

COR, 07:00-1800Hrs, M-F. A personal answering service is permitted at other than normal

Contract workdays and work hours for receipt of COR/PM emergency response work requirements, provided that the Program Manager or designee responds to all calls or emails within a time not to exceed two hours after notification of the call or email by the answering machine and/or service. The Program Manager and any individuals designated to act in that capacity shall have full authority to contractually bind the Contractor for prompt action on matters pertaining to execution of the PWS.

1.5.4 Meetings, Conferences and Briefings: The Contractor shall attend virtually or on site as requested by the Government, participate in, and furnish input to scheduled and unscheduled meetings, conferences, and briefings that relate to the functions and services herein as required by the Government to provide effective communication and impart necessary information. The

Commented [G(5]: We are proposing for the 30 day phase in/out period to be extended to 90 days.

Program Manager or designated representative shall attend meetings virtually or in person as requested by the Government. Meeting attendees shall, at all times, include Contractor managerial, supervisory, and other personnel knowledgeable of the subject matter. Meetings may start or end outside of regular duty hours.

1.5.5 Hours of Operation: The Contractor is responsible for conducting business, between the hours of 07:30 to 17:30 Monday thru Friday except Federal holidays or when the

Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the

Contractor will not be reimbursed when the Government facility is closed for the above reasons.

The Contractor must, at all times, maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, The Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.5.6 Recognized Holidays: The Contractor is not required to perform services on the following holidays:

New Year’s Day (January 1) Labor Day (1st Monday in September)

Birthday of Martin Luther King, Jr. (3rd Monday in January)

Columbus Day (2nd Monday in October)

President’s Day (3rd Monday in February) Veteran’s Day (November 11)

Memorial Day (Last Monday in May) Thanksgiving Day (4th Thursday in November)

Juneteenth National Independence Day (June 19)

Independence Day (July 4) Christmas Day (December 25)

1.5.7 Training Holidays: USAREUR-AF G6 has historically granted military personnel

Training Holidays as compensation for time that they spent in field training. These are typically combined with regular holiday leave schedules (for example, Christmas half days or day on day off schedules). Training Holidays are not official holidays and normal work hours are executed by the Contractor. However, announced training holidays or exodus of military personnel may provide the Contractor with an opportunity for marketing of the program. The Contractor shall take full advantage of such opportunities by planning actions that are better accomplished when such areas are vacant.

1.5.8 Quality Control: The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. The Quality Control Plan

(QCP) will be delivered to the Government with the Contractor proposal. After acceptance of the quality control plan the Contractor shall receive the Contracting Officer’s acceptance in writing of any proposed change to his QCP. Further information contained in paragraph 5.6.5.

1.5.9 Quality Assurance: The Government shall evaluate the Contractor’s performance

Commented [SGLCU6]: This is a Federal Holiday under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that The Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.10 Place of Performance: The place of performance for contract personnel and instructors are described at the discretion of the Government:

Duty Type Place of Performance

Key Personnel McCully Barracks or Clay Kaserne

Wiesbaden, Germany*

Site Coordinators Remote within Europe (NATO countries)

Instructors Remote within Europe (NATO countries)

*As determined by the Government; telework option available

The military installations correspond to AE-ITT fixed classrooms and the locations where the

Government currently has office space allocated. AE-ITT conducts training based on customer requirements. See Technical Exhibit 7.3 for a comprehensive list of all course classroom and

Mobile Training Team (MTT) locations. The list of MTT locations is dynamic with each location to be determined by the Government on a case by case basis in order to accommodate the AE-ITT training mission as required. MTT courses may be delivered physically or virtually on a case by case basis as determined by the Government.

1.5.11 Type of Contract: The Government will award a Hybrid Firm Fixed Price/T&M contract non TESA.

1.6 Security Program: Contractor personnel performing work are not required to have a security clearance T3 or higher under this contract. All Contractor personnel are required to have a completed background investigation with favorable results in accordance with DoDM

1000.13, DoD 8570.01M, DoD 5200.2-R and AR 25-2. The Contractor shall obtain access to the Local National Screening Program (LSNP). The background investigations will be requested by the Contractor before starting work on the contract, will be validated through the

USAREUR-AF G2 Security Office immediately after contract award, and must be maintained throughout the life of the contract. The type of background investigation is dependent upon the assigned functions and/or tasks as identified in the table below:

Function/Task Background Investigation

Program Manager National Agency Check with Inquiries (NACi) or equivalent Local National Screening Program (LNSP)

Security Management NACI / Tier 1 or equivalent (LNSP)

Instructor Police Good Conduct Certificate (PGCC)

LMS O&M Web/Database Administrator/Development

NACI or Tier I or equivalent (LNSP)

Training coordinator NACI or Tier 1 or equivalent (LNSP)

Training Program Helpdesk NACI or Tier 1 or equivalent (LNSP)

POI/Courseware Developer NACI or Tier 1 or equivalent (LNSP)

Mobile Training NACI or Tier 1 or equivalent (LNSP)

All NACI/Tier 1/LNSP positions may only be filled with a US, European Union (EU)/ NATO individual who has lived in Germany for at least 12 consecutive months

1.6.1 Security Information Handling: The Contractor shall ensure that Controlled

Classified Information (CUI) data is controlled, protected, and safeguarded in accordance with

AR 380-5 and current Army and DOD policy. CUI information shall be accessed and stored in government spaces only. The Contractor shall agree that any data furnished by the Government to the Contractor shall be used only for performance under this PWS, and all copies of such data shall be returned to the Government upon completion of this effort.

1.6.2 Physical Security: The Contractor shall be responsible for safeguarding all government equipment, information and property provided for Contractor use. When not physically present or at the close of each work period, government facilities, equipment, and materials shall be secured and Standard Form (SF 701) must be completed.

1.6.3 Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. Personnel will return all facility and classroom keys be accounted for and returned to the Government upon execution of contract modification; this does not apply to enduring personnel, located at the Wiesbaden/Wackernheim sites. NOTE: All references to keys include key cards where/as applicable. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting

Officer Representative or PM immediately upon determination. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting

Officer, re- key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due to the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the

Government and the total cost deducted from the monthly payment due the Contractor. The

Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by

Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the COR.

The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in The Contractor’s Quality Control Plan.

1.6.4 Special Qualifications: Contractor personnel performing work under this contract must have the required background investigation IAW the assigned duties and responsibilities as listed para 1.6.12. In addition all Contractors must be eligible to procure a Common Access

Commented [SGLCU7]: Can Americans fill this position?

Commented [V(8R7]: Updated

Card (CAC) or Alternate Smart Card Logon Token (ASCL) to perform duties and access the

Government’s unclassified network. The table below outlines the Information Assurance

Technical/Information Assurance Management (IAT/IAM) and IT privilege levels and basic certifications required (ref. paragraphs 1.6.11 and 1.7.2.1).

Function/Task IAT

Certification (DoDI 8140.02)

Other Certifications and Requirements

Program Manager and

Alternate Program Manager

IAM III

Baseline Certification: CISM or CISSP or

GSLC and 3yrs PM experience

Security Management

None

DBIDS Sponsoring

LMS O&M Web/Database

Administration/Development

IAT level II Baseline Certification: CompTIA Security+, CCNA Security, SSCP or GSEC commercial certification (or higher, such as CISSP, etc.).

Computing Environment Certification: Must have one or more of the following: JavaScript, C++, Windows Communication Foundation

(WCF), Web Services, XML, XSL, XPath, SOAP, CSS, HTML, ASP.NET, Microsoft SQL Server, SQL / T SQL, Microsoft Team Foundation

Server (TFS), Microsoft IIS, ++Microsoft Visual Source Safe (VSS), or the

.NET Framework.

Instructor None Required latest certification to teach assigned course. The certification must be up to date with current exam version.

Instructors will have 60 days to certify in a new courseware version from the released date. i.e.: CompTIA, ISACA, PMI, ISC2, CISCO, Microsoft, etc. the instructor will have 60 days from the release date to become certified.

Testing Services None Virtual Testing Support

Training coordinator None

Training Program Helpdesk None

POI/Courseware Developer None

Mobile Training None

Commented [SGLCU9]: Is this position still required?

Isn’t this no longer required?

Commented [V(10R9]: This is an embedded position to process personnel paperwork through IACS. An example if required to deliver on site, the instructor needs to have access to the post

1.6.5 Defense Biometric Identification System (DBIDS): U.S. Army Installations participate in a standardized entry protocol known as the DBIDS. This program requires a standardized background check, an identification badge and entry procedures for all Contractors requiring routine access to the site location. Utilization of this system streamlines access for authorized Contractor employees by eliminating the need to obtain day passes. S. The Contractor shall provide all necessary and accurate information to obtain and maintain enrollment in the

DBIDS. The Contractor shall ensure personnel enrolled in DBIDS remain enrolled during the entire period of performance during which that Contractor/employee is needed.

1.6.6 Anti-Terrorism (AT) Level 1 Training: All Contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall have AT Level I awareness training completed within 30 calendar day after contract start date, or within 30 calendar days of new employees' commencing performance. All

Contractor and subcontractor employees will complete this training annually. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee to the COR or Contracting Officer within 30 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at http://jko.jten.mil/courses/atl1/launch.html.

1.6.6.1 Pursuant to DoDI 2000.16, "DoD Antiterrorism (AT) Standards," each Contractor employee requiring access to a Federally-controlled installation, facility and/or Federally-controlled information system(s) shall complete Level I AT Awareness Training on an annual basis and receive a certificate of completion. The training is accessible from any computer and is available at https://jkodirect.jten.mil/ The Contractor is responsible for ensuring that all applicable employees have completed antiterrorism awareness training and shall certify that their workforce has completed the training through the submission of completion certificate(s) to the

Contracting Officer and the Contracting Officer's Representative (if appointed) within five working days after contract award or prior to access to a Federally-controlled installation or information system.

1.6.6.2 In the event that the automated system at https://jkodirect.jten.mil/is not available (e.g., server problems), Level I AT Awareness Training can be provided by a qualified instructor. However, if the training is not complete online, the Level I AT Awareness Instructor qualification must be coordinated with the Installation Antiterrorism Officer (or Installation Security equivalent) and the resultant name(s) of approved instructors shall be provided the Contracting Officer or designee along with all associated cost or schedule impacts to the contract. Antiterrorism performance (Level I AT Awareness Training attendance and compliance) may be documented as a performance metric under the resultant contract, and be part of past performance information in support of future source selections.

1.6.7 AT Awareness Training for Overseas Travel: Contractors required to travel overseas while performing requirements of this contract will comply with the DoD Foreign

Clearance Guide at https://www.fcg.pentagon.mil/fcg.cfm and the Department of State Travel

Warnings at travel.state.gov.

1.6.8 iWatch Training: The Contractor and all associated subcontractors working within an

Army-controlled installation, facility, or area, will brief all employees on the local iWatch

Commented [SGLCU11]: Now Defense Biometric

Identification System (DBIDS)

Commented [V(12R11]: UPDATED

Commented [SGLCU13]: This link doesn’t work

Commented [V(14R13]: UPDATEDUPDATE

Commented [SGLCU15]: This link doesn’t work

Commented [V(16R15]: UPDATED http://jko.jten.mil/courses/atl1/launch.html https://directives.whs.mil/issuances/O200016v1_dodi_2016.pdf http://jko.jten.mil/courses/atl1/launch.htmlis http://www.fcg.pentagon.mil/fcg.cfm program (training standards provided by the requiring activity Antiterrorism Officer). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training will be completed within 30 calendar days of contract award and within 30 calendar days of new employees' commencing performance, with the results reported to the COR no later than 60 days after contract award.

1.6.9 Army Training Certification Tracking System (ATCTS): All Contractor employees with access to Government information system must be registered in the Army Training

Certification Tracking System (ATCTS) at commencement of services and must successfully complete the Cyber Awareness Challenge Training prior to access to the information system and then annually thereafter. Additionally personnel must annually sign an acceptable use policy

(AUP). The training is available online at https://cs.signal.army.mil/

1.6.10 Operational Security (OPSEC): The Contractor shall comply with the

USAREUR-AF G6 OPSEC plan and standard operating procedures (SOP).

1.6.10.1 The Contractor shall comply with all applicable Department of Defense (DoD) security regulations and procedures during the performance of this contract. The Contractor shall not disclose and must safeguard sensitive information, computer systems and data, Privacy Act data, and Government personnel work products that are obtained or generated in the performance of this contract.

1.6.10.2 Neither the Contractor nor any of its contract service providers shall disclose or cause to disseminate any information concerning operations of military activities. Such action(s) could result in violation of the contract and possible legal actions.

1.6.10.3 Per AR 530-1, “Operations Security,” new Contractor employees must complete Level

I OPSEC training within 30 calendar days of reporting for duty. All Contractor employees must complete annual OPSEC awareness training. Training will be provided by the requiring activity.

Training is available online through Joint Knowledge Online.

1.6.11 Cyber Security (CS)/Information Technology (IT) Training and Security

Certification: Contractors conducting IA functions on national security systems must meet

Committee on National Security Systems training requirements.

1.6.11.1 All Contractor employees and associated subcontractor employees must complete the

DoD Cyber Awareness Challenge Training before issuance of network access and annually thereafter. All Contractor employees working CS/IT functions must comply with DoD and

Army training requirements in DoDI 8140.02 and AR 25-2 at start of employment. The training is available online at https://cs.signal.army.mil/DoDIAA/default.asp

1.6.11.2 All DoD Contractor employees whose duties are in the Information Technology and

Telecommunications (ITT) and Cybersecurity (CS) areas will be assigned a position sensitivity of Tier I, Tier-II or Tier-III. Personnel designated as a Tier-1or II must obtain and maintain a

Single Scope Background Investigation (SSBI) or Local National Security Program (LNSP).

Personnel designated as a Tier-III must obtain and maintain a National Agency Check with

Local Agency and Credit Check (NACLC). Each FSO will forward the requests for background investigations to the Office of Personnel Management (OPM) within 3 working days of receipt https://cs.signal.army.mil/ https://cs.signal.army.mil/DoDIAA/default.asp of all required paperwork. If contract becomes classified the Garrison Security Office must be notified. All Contractor personnel if requiring elevated network privileges must comply with training and certification requirements set forth in DoD 8570.01- M, Information Assurance

Workforce Improvement Program Incorporating Change 4, 11/10/2015. All personnel requiring network access must sign an acceptable use policy (AUP) and accomplish user training prior to being granted a network account.

1.6.11.3 All Contractor employees and associated subcontractor employees' supporting

CS/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

1.6.12 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The

Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the Contracting Officer will apprise the Contractor of how the

Government views The Contractor's performance and the Contractor will apprise the

Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.7 Personnel/Positions

1.7.1 Contracting Officer Representative (COR): The (COR) will be identified by a separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that The

Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the

Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies;

coordinate availability of Government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to The Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.7.2 Key Personnel: The following personnel are considered key personnel by the

Government: Program Manager, Alternate Program Manager, and LMS O&M Web/Database

Administrator/Developer. The Contractor shall provide a Program Manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for The Contractor when the manager is absent shall be designated in writing to the

Contracting Officer. The Program Manager or alternate shall have full authority to act for The

Contractor on all contract matters relating to daily operation of this contract. Qualifications for all key personnel are listed below:

1.7.2.1 Program Manager and Alternate: The Program Manager and Alternate shall be IAM-

Commented [SGLCU17]: Update so this provides LNSP applicability

Commented [V(18R17]: UPDATED

Commented [SGLCU19]: DoDD or DoDI

Commented [V(20R19]: Still DOD 8570.01M

Commented [SGLCU21]: Are these personnel or solely positions? 3 personnel identified

Clearly identify difference between

Commented [V(22R21]: These are key positions that must be filled and names identified when contractor bids on their proposals.

III certified and have three years’ experience overseeing the delivery of services for a complex program with performance/oversight at multiple sites, geographically dispersed. It is acceptable if the Program Manager and/or Alternate has passed their certification examination and are working towards the experience necessary for full certification.

1.7.2.2 LMS O&M Web/Database Administrator/Developer: The LMS O&M

Web/Database Administrator/Developer must meet the qualification listed in para 1.6.4 and have three years’ experience with .NET Web programming and database development. In addition, the Contractor have a two years’ experience with the following operating systems/protocols:

Microsoft Server 2012/2016 or later version, Windows 10 or latest version of the operation and administration, and Network Administration.

1.7.3 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by Contractors are suitably marked as

Contractor products or that Contractor participation is appropriately disclosed. Contractor personnel shall wear a Contractor ID badge (Name/Picture/Army Europe-Information

Technology Training Contractor) when performing work under this contract to include attending

Government meetings and conferences. Signature block must be standardize and identifying themselves as AE-ITT Contractor.

1.8 Contractor Travel: Contractor may be required to travel to attend annual cybersecurity summits or workshops within the Wiesbaden area, attend and represent the AE-

ITT Program, and provide instruction and briefings.

1.9 Other Direct Costs (ODC): The Government will reimburse the Contractor for any training cost associated with travel from the Wiesbaden AOR for conducting Government approved Mobile Training Teams (MTT) training at an offsite location. Reimbursement includes the /equipment setup and shipping of computers and any travel costs associated with travel outside of the local commuting area of an AE-ITT official duty station (see Part 2, Definitions and Acronyms) where/as necessary; case by case bases determined by the

Government. The Government will also reimburse the Contractor for any Government approved Course Vouchers as outlined in para 5.5.7.

1.10 Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the

Government with all rights and privileges of ownership/copyright belonging exclusively to the

Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights. The Government has the rights to inspect and approve /disapprove any courseware or materials offered through this program. The Contractor must ensure that all copyright laws are met when utilizing any copyrighted materials for course quizzes/tests.

Commented [S(23]: Separate paragraph for PM and

Alternate make note of roles vs position.

Commented [G(24]: 1.7.2.3 LOCATION OF

CONTRACTOR EMPLOYEES - specify whether they will be virtual, onsite, local, remote

Commented [SGLCU25]: MTT applicable since this is virtual

Commented [V(26R25]: Yes, we may be asked for onsite training

1.11 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting

Officer may affect other remedies as he or she deems necessary, including prohibiting the

Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.12 Safety: N/A

1.12.1 Safety Plan and Program: N/A

1.13 Environmental Compliance: N/A

1.13.1 Environmental Compliance Plan and Program: N/A

1.14 Authorized to Accompany the Force: Contractors will comply with DFARS Clause

252.225-7740.

1.14 Performance in a Foreign Country: Contractors will comply with DFARS Clause

252.225-7043. U.S. entity Contractors will affiliate with the Department of State Overseas

Security Advisory Council (OSAC) https://2009-2017.state.gov/ m/ds/terrorism/c8650.htm

All U.S. and non- local national employees will comply with the travel requirements in the

DoD Foreign Clearance Guide.

Part 2

Definitions and Acronyms

2 Definitions and Acronyms:

2.1 Definitions

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer - A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note:

The only individual who can legally bind the Government.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to The Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable - Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

Key Personnel - Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

Official Station – An area defined by the agency that includes the location where the employee regularly performs his or her duties or an invitational traveler’s home or regular place of business (see Federal Travel Regulation §301-1.2). The area may be a mileage radius around a particular point, a geographic boundary, or any other definite domain, provided no part of the area is more than 50 miles from where the employee regularly performs his or her duties or from an invitational traveler’s home or regular place of business. If the employee’s work involves recurring travel or varies on a recurring basis, the location where the work activities of the employee’s position of record are based is considered the regular place of work.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance - The Government procedures to verify that services being performed by

The Contractor are performed according to acceptable standards.

Quality Assurance Surveillance Plan (QASP) - An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

Quality Control - All necessary measures taken by The Contractor to assure that the quality of an end product or service shall meet contract requirements.

SubContractor - One that enters into a contract with a prime Contractor.

Work Day - The number of hours per day The Contractor provides services in accordance with the contract.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

2nd TSSB 2nd Theater Strategic Signal Brigade

AARs After Action Reviews

ACOR Alternate Contracting Officer's Representative

AE-ITT Army Europe - Information Technology Training

AFARS Army Federal Acquisition Regulation Supplement

AIS Automation Information Systems

AMC Army Material Command

AO Authorizing Official

AOR Area of Responsibility

AR Army Regulation

ATCTS Army Training and Certification Tracking System

BBP Best Business Practice

CAC Common Access Card

CAP Certified Authorization Professional

CASP CompTIA Advanced Security Practitioner

CCE Contracting Center of Excellence

CCNA Cisco Certified Network Associate

CE Computing Environment

CEH Certified Ethical Hacker

CEST Central European Summer Time

CFR Code of Federal Regulations

CIO Chief Information Officer

CISA Certified Information Systems Auditor

CISM Certified Information Security Manager

CISSP Certified Information Systems Security Professional

CLIN Contract Line Item Number

CND-SP Computer Network Defense – Service Provider

CONUS Continental United States (excludes Alaska and Hawaii)

COR Contracting Officer Representative

COTR Contracting Officer's Technical Representative

COTS Commercial-Off-the-Shelf

CP-34 Career Program 34

CPAR Contract Performance Assessment Report

CS Cybersecurity

CSD Courseware Development Timeline

CSF Cyber Security Fundamentals

CSIH Computer Security Incident Handler/Handling

CSNM Cyber Security Network Manager

CSSLP Certified Secure Software Lifecycle Professional

CSTP Cybersecurity Training Program

DA Department of the Army

DAA Term replaced by "AO" Authorizing official

DBA Database Administrator

DBMS Database Management System

DD250 Department of Defense Form 250 (Receiving Report)

DD254 Department of Defense Form 254 (Contract Security Requirement List)

DFARS Defense Federal Acquisition Regulation Supplement

DIACAP Term replaced by "RMF" Risk Management Framework

DISA Defense Information Systems Agency

DLA Defense Logistics Agency

DMDC Defense Manpower Data Center

DoD Department of Defense

DODD Department of Defense Directive

DODDS Department of Defense Dependent Schools

DoDIN Department of Defense Information Network

DODI Department of Defense Instruction eMASS Enterprise Mission Assurance Service Site

EU European Union

EUCOM European Command

FAR Federal Acquisition Regulation

FM Field Manual

FN Foreign National

FTR Federal Travel Regulation

G6 Communications Staff Section

GAPM Government Appointed Program Manager

GCFA GIAC Certified Forensic Analyst

GCIA GIAC Certified Forensic Analyst

GCIH GIAC Certified Incident handler

GPO Group Policy Object

GSEC GIAC Security Essentials Certification

GSLC GIAC Cyber Security Leadership Certification

HIPAA Health Insurance Portability and Accountability Act [of 1996]

HQ Headquarter

IA BBP Information Assurance Training Best Business Practice

IASAE Information Assurances System Architect Engineer

IAT Information Assurance Technician

IAW In Accordance With

IAWF Information Assurance Workforce

ID Identification

IMCOM Installation Command

IMO Information Management Officer

INSCOM Intelligence and Security Command

ISACA Information Systems Audit and Control Association

ISC2 International Information systems Security Certification Consortium

ISSM Information System(s) Security Manager

ITIL Information Technology Infrastructure Library

ITTP Information Technology Training Program

JKO Joint Knowledge Online

JPAS Joint Personnel Adjudication System

JTR Joint Travel Regulation

KO Contracting Officer

LMS Learning Management System

MARFOREUR Marine Forces Europe

MCITP Microsoft Certified Information Technology Professional

MIS Management Information System

MOC Microsoft Official Certification

MTT Mobile Training Team

NA Network Administrator

NACI National Agency Check with Inquiries

NACLC National Agency Check with Local Agency Check and Credit

NATO North Atlantic Treaty Organization

NAVEUR U.S. Navy in Europe

NIPRNet Non Classified Internet Protocol Router Network

OCI Organizational Conflict of Interests

OCONUS Outside Continental United States (includes Alaska and Hawaii)

ODC Other Direct Costs

PIPO Phase In/Phase Out

PRS Performance Requirements Summary

PWS Performance Work Statement

QA Quality Assurance

QAP Quality Assurance Program

QASP Quality Assurance Surveillance Plan

QC Quality Control

QCP Quality Control Plan

RAID Redundant Array of Independent Disks

RFQ Request for Quote

RMF Risk Management Framework

SA System Administrator

SACEUR Supreme Allied Commander Europe

SIPRNet Sensitive Internet Protocol Router Network

SME Subject Matter Expert

SOCEUR Special Operations Command

SOP Standard Operating Procedure

SPAWAR Space and Naval Warfare Systems Command

SQL Structured Query Language

SSBI Single Scope Background Investigation

SSCP Systems Security Certified Practitioner

TCO Telephone Control Officer

TE Technical Exhibit

TESA Technical Expert Status Accreditation

TRADOC U.S. Army Training and Doctrine Command

USAFE U.S. Air Forces in Europe

USAFRICOM U.S. Africa Command

USEUCOM U.S. European Command

UTC Universal Time Coordinated

VCC Visitor Control Custodian

VTC Virtual Training Capability

VUE Virtual University Enterprise

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT AND SERVICES

3. Government Furnished Items and Services

3.1 Services: The Government will provide internet connectivity, network access, through either the US Army NIPR network or a commercial ISP network, and DSN phone connections to permanent locations and administrative spaces.

3.2 Upon background validation, the Government will provide DBIDS base access sponsorship and Trusted Associate Sponsorship System (TASS) for issuance of a CAC/ID card to access Government systems, as required.

3.3 Facilities: The Government shall provide when required to primary staff office space, telephone service, workstations, computers, system access, and storage space at the place of performance. The Government’s property shall be used only in performance of this task, unless otherwise provided in this contract and unless otherwise approved by the Contracting Officer, Government program manager. The Government shall provide Contractors adequate working space and furnishings similar to that provided for Government employees. This includes computers, network services, phones and other data collection equipment/software as determined necessary by the Government.

3.4 Utilities: Not applicable.

3.5 Equipment: With exception of contract-hired instructors, the Government will provide all office automation equipment (e.g. workstation, phone, and printer), classroom training equipment (e.g. computers, printer, routers, projectors, VTC cameras, screens, etc.) necessary to conduct training at AE-ITT training sites and Mobile Training Kits/equipment (laptop transport cases, laptops, printers, and wired router) necessary to provide training in on-demand/ad hoc training locations.

3.6 Materials: The Government will not provide office supplies required to support the training program.

Commented [SGLCU27]: IACS reference DBIDS new system

Commented [SGLCU28]: In a virtual environment does this apply or is this for Wackernheim and Wiebaden location

Why is this in here for a Virtual Facility?

Commented [V(29R28]: This is when required, we do meet in Wackernheim to conduct business.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. Contractor Furnished Items and Services

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform virtual work under this contract that are not listed under Part 3 of this

PWS. The Contractor is responsible for all commercial courseware, custom courseware, distribution of training material,

4.2 Secret Facility Clearance: Not applicable.

4.3 Materials: The Contractor shall furnish all courseware-training materials, eBooks/textbooks and associated certification exam vouchers to ensure certification of trained workforce. The Contractor is responsible for the delivery of all courseware.

4.4 Equipment: The Contractor shall provide support to ensure virtual testing is delivered as identified in para 5.5.2

4.5 Services: When connectivity is required and is not provided by the Government, the Contractor will provide network connectivity

PART 5

SPECIFIC TASKS

5. Basic Services: Contractor shall provide services in support of the USAREUR- AF G6 Information Technology Training (AE-ITT) Program. The AE-ITT Program is an enterprise CS/IT training capability that is flexible in nature and designed to assist the

Government in meeting the numerous and diverse CS/IT training and certification requirements of the CS workforce…