J.1 ECATPS v1.1b SOW_6-30-22.pdf

Enterprise Cybersecurity Awareness and Training

Program Support

Statement of Work

Version 1.1b

June 30, 2022

Table of Contents

1 Scope

1.1 Background

1.2 Purpose

1.3 Information Security Awareness Training

2) Requirements

2.1 Task Area 1: Program Management

2.2 Task Area 2: Training and Awareness Development Support

2.2.1 Task Area 2.1: Training Modernization

2.2.2 Task Area 2.2: LMS Support

15) Provide general LMS assistance and support for course, users, registration, and navigation issues and functionality

2.2.3 Task Area 2.3: CyberVet Training

2.2.4 ** Optional Task ** Task Area 2.4: Content Development Services

2.2.5 ** Optional Task ** Task Area 2.5: Information Security and Privacy Awareness Training

2.2.6 **Optional Task** Task Area 2.6: Internal Staff Training Program Support

2.2.7 Task Area 2.7: Training Requirements for Cleared Employees

2.2.8 **Optional Task** Task Area 2.8: Live Application Security Training Support

2.2.9 Assumptions, SLAs, and Operating Constraints

3 Contract Management Requirements

3.1 Project Status Meetings

3.2 Key Personnel

3.3 Deliverables

3.4 Assumptions

3.5 Government-Furnished Information, Equipment, & Facilities

4 Transition Activities

4.1 Transition-In from an Existing Contractor

4.2 Transition-Out – Optional Task

4.3 Transition Plans and Procedures

4.4 Training

5 SECTION 508 - ACCESSIBILITY OF ELECTRONIC AND INFORMATION

TECHNOLOGY

Section 508(2)(A) of the Rehabilitation Act of 1973, as amended by the Workforce Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board (Access Board) Electronic and Information Accessibility Standards (36 CFR part 1194), establish information technology accessibility standards for the Federal government. Section 508(a)(1) requires that when Federal Agencies develop, procure, maintain, or use Electronic and Information Technology (EIT), they shall ensure that the EIT allows federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. The Section 508 requirement also applies to members of the public seeking information or services from a Federal Agency. At a minimum, all deliverables submitted to the Government must be 508 compliant. Section 508 text is available at http://www.opm.gov/HTML/508-textOfLaw.htm or http://www.section508.gov/

As required by HHSAR 352.239-74, Electronic and Information Technology Accessibility, the Section 508 accessibility standards applicable to this contract or order are identified as follows:

Functional Performance Criteria:

The following standards are applicable:

All WCAG A & AA Success Criteria apply

602 Support Documentation

603 Support Services

302 Functional Performance Criteria

The following standards are applicable:

All WCAG A & AA Success Criteria - except

2.4.1 Bypass Blocks

2.4.5 Multiple Ways

1 Scope

1.1 Background

The Centers for Medicare & Medicaid Services (CMS) is a federal agency of the U.S. Department of Health & Human Services (HHS) that is responsible for administering Medicare, Medicaid, the Children’s Health Insurance Program (CHIP), and the Health Insurance Marketplace programs. A key initiative of the agency is to help the approximately 100 million people covered under these programs receive high quality, better healthcare that results in lower costs.

CMS is responsible for the payment of approximately $1 trillion each year for medical services rendered to over 100 million program beneficiaries and recipients. The organization carries out its mission through employment of approximately 4,500 employees located at its central office site in Baltimore, and in 10 regional offices located in major cities throughout the United States. The agency contracts with numerous companies to process claims for reimbursement for medical services rendered under the Medicare program, and works with all 50 states, the District of Columbia and the Territories in the administration of the Medicaid and CHIP programs.

In the administration of these programs, CMS utilizes many assets, including buildings, facilities, communications equipment, computer systems, employees, Contractors, public trust, and information.

A loss to any one of these assets could negatively affect the goals, the mission or the quality of support necessary for CMS to deliver and provide to its customers, stakeholders, and to the American public.

Additionally, CMS collects, uses, and stores information that is defined as Personally Identifiable Information (PII), Protected Health Information (PHI), proprietary data, procurement data, inter-agency data, sensitive information, and / or privileged system information. Access to and the necessary protections of information can be controlled by the Privacy Act of 1974 (as amended), the Computer Security Act of 1987 (as amended), the E-Government Act, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Federal Information Security Management Act (FISMA) of 2002, as well as many other important and relevant rules, regulations, policies, and guidelines promulgated by HHS, the Office of Management and Budget (OMB), and the National Institute of Standards and Technology (NIST). As a result, CMS has a responsibility to collect, use, and / or disclose information properly and in accordance with federal regulations, to safeguard it at all times, and to maintain the confidentiality, integrity, and availability (CIA) of information and information systems.

To safeguard the CIA of its information and information systems effectively, CMS has established an enterprise-wide cybersecurity and privacy program led by the Information Security and Privacy Group (ISPG). ISPG is charged with protecting CMS data as it “provides leadership to CMS in managing information security and privacy risks appropriate for evolving cyber threats”. ISPG executes this vision utilizing an innovative approach to provide optimal visibility, situational awareness, resilience and incident response readiness across all CMS FISMA Systems.

The ISPG Security and Privacy program is responsible for defining policy, providing security and privacy services, and leading compliance and oversight of the program. The ISPG is comprised of five divisions:

Division of Security and Privacy Compliance (DSPC), Division of Cyber Threat and Security Operations (DCTSO), Division of Security, Privacy Policy and Governance (DSPPG), Division of Strategic Information (DSI), and Division of Implementation and Reporting (DIR); and supported by the Front Office. The following table states the responsibilities for each division.

Division Description

Security and Privacy Compliance

Manage the cybersecurity and privacy risk across CMS Centers and Offices for known security weaknesses and emerging cyber threats. Implement and manage the security authorization process (formerly called certification and accreditation) and develop a strategy and process to transition to a Continuous Diagnostic and Monitoring model to include Ongoing Authorization consistent with OMB and NIST guidance.

Cyber Threat and Security Operations

Mature the CMS Cybersecurity Integration Center (CCIC) to serve as a centralized focal point for incident response and oversight of all security operations centers servicing CMS. Mature cyber threat intelligence program into a comprehensive view of risk across CMS to include our federal, state, and commercial partners.

Information and Reporting

Establish an integrated security monitoring & reporting ecosystem that encompasses all FISMA systems across the CMS enterprise and leverages the tools/processes that measure security compliance, to identify and prioritize cybersecurity risks/defects on a near real-time basis, and enhanced data analytics and process automation, to facilitate risk-based management by providing actionable information to leadership and risk managers at the agency, Department, and DHS level that results in improving CMS’s cybersecurity and privacy risk posture and alignment with federal requirements

Security, Privacy Policy and Governance

Establish security and privacy policy consistent with federal and HHS requirements and guidance. Ensure alignment of security and privacy policy with enterprise efforts in system develop lifecycle, enterprise architecture, and Federal IT Acquisition Reform Act (FITARA).

Strategic Information

Responsible for implementing programs to detect, identify, and mitigate foreign intelligence and insider threats to CMS personnel, facilities, information systems, supply chain, healthcare programs, and National Security Information.

Table 1- CMS ISPG Division Areas Described

ISPG works in close collaboration with contractor support and looks to this support not only to provide subject matter expertise and thought leadership, but also to take ownership of responsible work, manage quality, and provide the government with deliverables that are finished products ready to be delivered to senior management or ISPG customers across the agency. “Finished Products” are concise, relevant, well-formed and professional in appearance with content checked for accuracy and adherence to objectives through a contractor-managed quality control process.

The successful implementation of security and privacy controls to protect all information assets requires not only alignment with federal legislation, mandates, and executive orders, but also a collaborative approach between ISPG and all CMS FISMA system stakeholders.

The ISPG organizational chart is depicted below.

Table 2- CMS ISPG Divisions

This interoperability is accomplished through close collaboration between roles including the ISPG Cyber Risk Advisor (CRA), the Privacy Advisor, the Data Guardian (DG), and the systems Information System Security Officers (ISSOs). Additional key roles integral to the program’s operations and successes includes the Chief Information Officer (CIO), Chief Information Security Officer (CISO), the Senior Official for Privacy (SOP), and the Program Executive / Business Owner.

1.2 Purpose

This Statement of Work (SOW) describes the enterprise-wide Cybersecurity and Privacy Awareness and Training Program support requirements needed to consolidate existing ISPG training efforts and support the continuation of the program’s training activities of ISPG. Tasks and activities completed by the contractor will service ISPG, as well as ISPG’s OIT Group partners and customers, to promote transparency, accountability, less duplication of effort, and improved program and cost efficiency. To meet these objectives, the Contractor has responsibilities in the following task areas:

• Project management

• Support the ISPG training team

• Consulting expertise to address emerging challenges and operation requirements within the awareness and training program

• Provide training content development services and delivery

• Provide subject matter expert support for the development, delivery and maintenance of a comprehensive information security and privacy awareness and training program

• Develop and implement curriculum using the cognitive apprenticeship learning model

• Recommend, employ, and manage a unified learning management solution

• Actively participate in the support, development, refinement, and delivery of the CyberVet-cohort program, monitor, and provide feedback on the progress and results of both the cohorts and the program with recommendations to ISPG

1.3 Information Security Awareness Training

The Federal Information Security Management Act (FISMA) requires each federal agency to develop, document and implement an agency-wide program to provide information security for the information and systems that support the operations and assets of the agency, including those provided or managed by another agency or contractor. The 2014 FISMA designates NIST with responsibility to develop guidance to federal agencies on information security and privacy requirements for federal information systems.

As an operating division of the HHS, CMS must also comply with the HHS IS2P, Privacy Act of 1974 (“Privacy Act”), the Privacy and Security Rules developed pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and the E-Government Act of 2002, which relates specifically to electronic authentication requirements. The HHS Office for Civil Rights (OCR) is responsible for enforcement of the HIPAA Security and Privacy Rules. CMS seeks to comply with the requirements of these authorities, and to specify how CMS implements compliance in the CMS Information Systems Security and Privacy Policy (IS2P2).

HHS and CMS governance documents establish roles and responsibilities for addressing privacy and security requirements. In compliance with the HHS Information Systems Security and Privacy Policy (IS2P), the CMS CIO designates the CMS CISO as the CMS authority for implementing the CMS-wide information security program. HHS also designates the CMS SOP as the CMS authority for implementing the CMS-wide privacy program. Through their authority given by HHS, the CIO and SOP delegate authority and responsibility to specific organizations and officials within CMS to develop and administer defined aspects of the CMS Information Security and Privacy Program.

The CISO is responsible for providing training opportunities to further the effectiveness of the information security program. CMS must ensure that 100 percent of the agency’s employees and contractors receive annual information security awareness training and role-based training in compliance with OMB A-130, Federal Information Security Management Act (FISMA), and National Institute of Standards and Technology (NIST) (Draft) Special Publication (SP) 800-16 Rev.1.

2) Requirements

2.1 Task Area 1: Program Management

The Contractor shall perform all project management duties, including technical and business management functions, to plan, implement, track, report, and deliver the services requested under this contract, including but not limited to:

1) Maintain a schedule of project activities and deliverables

2) Develop, maintain, and report on service level agreements (SLAs)

3) Quality Assurance

a. The Contractor shall include Quality Assurance (QA) as part of large and small tasks performed. QA procedures should be on a scale appropriate for the size, criticality, and complexity of the task order requirements. QA applies to all deliverables, including project plans, periodic reports, findings and reports, gap analysis, training materials, written and verbal, and technical advisory services for security related documentation. All written deliverables shall be clearly written without any grammar or spelling errors. At a minimum, the Contractor shall provide CMS with QA that will:

i. Provide a planned process which makes certain that products are produced in conformance with established standards and requirements

ii. Promote secure systems with quality built in early in the development lifecycle based on consistent application of information security guidance

iii. Establish a uniform/structured approach to make certain that quality considerations are addressed regarding information security with emphasis on early security risk detection and continuing improvement of the development and QA process

iv. CMS has the right to inspect, observe, and evaluate all work performed and all work efforts or products as they progress and is not limited to the final deliverables. CMS shall review all work products developed by the Contractor(s) prior to finalization. Final acceptance of all work products is subject to CMS’s approval. CMS retains ownership of all work products

4) Weekly Project Status Reporting to include:

a. An overview of the items completed since the last reporting period

b. An overview of the project status with a focus on outstanding issues and risks

c. An overview of the work to be performed through the next reporting period

d. Status of any performance metrics (if applicable)

5) Conduct weekly project status meetings to review the weekly project status report (see contract Management requirements)

6) Prepare Monthly Reports (see contract Management requirements)

7) Conduct Monthly Contract Management Meetings (see contract Management requirements).

2.2 Task Area 2: Training and Awareness Development Support

2.2.1 Task Area 2.1: Training Modernization

The contractor will review the current training program and emerging draft materials within ISPG and OIT to gain an understanding of the scope of the programs, materials, infrastructure, desired organizational and individual learning outcomes and supporting training goals and objectives. The outcome of the review should inform a plan or strategy for aligning work efforts underway, future developmental work, existing curriculum and supporting materials, and learning strategies for a cohesive approach across all the various programs. All learning and performance outcomes should align with the current version of the NIST NICE Framework considering compliance and levels of maturity in implementing the May 2019, Executive Order on American’s Cybersecurity Workforce, and the Training Modernization Initiative. The following elements and activities have been identified to meet the needs of the CMS workforce learners and help make training efforts successful:

1) Strategically support the deployment and maintenance of a unified training management solution –

a. Support and maintain, as necessary, a Learning Management System (LMS) that will seamlessly manage participant registration, creation, distribution, and reporting of all training activities across ISPG and OIT to ensure compliance and audit-readiness.

b. The LMS will have the ability to integrate with external designated content management systems rather than siloing all learning content internally to the system. This system will also provide integration with other virtual technologies – e.g., Pluralsight or Zoom – through specifications such as IMS Global’s Learning Tools Interoperability (LIT) specification. This is common in current LMS solutions.

c. Also, this solution will incorporate the latest tracking be able to assess the learner’s prior learning and data specifications – i.e., xAPI – for providing cloud-based tracking of learner performance through a learning record store (LRS) and either built-in or SaaS analytical solutions for analyzing LRS data and reporting using dashboards.

2) If necessary, identify and provide strategic support in deploying and integrating a learning analytics dashboard –

a. The dashboard must provide necessary analytical data and insight not only for management but also for the individual learner. Using these analytics as an open social learner model (leader board) could provide individuals with the ability to track their status and progress towards organization and individual professional learning goals. In some cases, and if appropriate, views could be opened to peers or other groups to allow individual benchmarking and insight to how a learning community is doing and one’s place within it.

3) Improve and support use of a more streamlined, regular, less complex solution for tracking compliance of training and awareness achievements/requirements and ensuring all content development complies with applicable areas including Section 504 and Section 508 of the Rehabilitation Act prior to use or release.

4) Provide strategic developmental and evaluative support to ensure that interactive courses are relevant and engage learners experientially –

a. Interactivity in an online training program is very important. Online courses need to be engaging and interactive to meet learner expectations today, and one of those expectations is having control over the learning experience. Because most people are constantly interacting with content on their phones, televisions, etc., they are used to being in control. An interactive course gives learners some control over the learning process and requires participation, which drives engagement. Courses that are problem-base and provide opportunities for “learning by doing” with real problems and situations are not only engaging to the learner but allow the development of critical cybersecurity meta skills or higher-order outcomes – i.e., problem solving, critical thinking or information evaluation and communication.

5) ** Optional ** Provide identification of and strategic deployment and developmental support for mobile platform access to training – This supports the need for mobile access to online educational programs. Mobile access is especially critical when educating large audiences with variable work environments. Mobile learning enables this. It also directly enables both spaced learning and micro or bite-sized learning described below.

6) Provide support for developing and executing a plan to implement spaced learning – ideally using mobile technologies the “forgetting curve” can be mitigated by presenting concepts to learners over spaced periods of time – days or weeks – to remind learners of the concept, possibly quiz them or in general, keep it fresh in the mind. This paired with micro learning or other modalities is highly effective and is a push technique. Pushes could also occur with just-in-time information that changes rapidly.

7) Provide consulting support for planning and implementing an approach for maximum learning flexibility to accommodate highly varying schedules – One of the keys to creating a successful online educational program for large audiences is ensuring training fits into any learner’s schedule. Members of the CMS community all have different schedules. A flexible, on-demand program can educate each type of professional at their own pace, as their schedule permits.

8) ** Optional ** Provide strategic support in implementing bite-sized (micro) Learning – Finding time for training can be particularly challenging for employees, who are able to devote little time to learning. Training is often squeezed in at their desk or in spare time during the evening or weekend. Employees also increasingly want to be able to access “just-in-time” learning at the point of need. When learning is available in small, bite-sized chunks, and is easily accessible, via a smartphone, for example, employees can leverage it for just-in-time learning/training/knowledge at the point of need. Contextual learning can also boost an employee’s learning retention and provide a much higher degree of value and relevancy.

Informal learning, gamification, and individual motivation - Tracking of informal learning experiences and providing organizational recognition for individual learning initiatives that are aligned with job performance and the ISPG mission. Such initiatives could entail accessible online courses, capture the flag activities (operations), or certification courses outside of CMS.

Be using gamification techniques in upskilling or other needs, individual motivation could be enhanced with badges and leaderboards as trajectories and professional levels are documented.

9) Provide strategic support and consultation to the development and implementation of a plan to track informal learning experiences and integrate tracking data within a learning analytics dashboard supporting visibility into informal learning activities, workforce competency mapping and individual badging and recognition; providing organizational recognition for individual learning initiatives that are aligned with job performance and the ISPG mission. Such initiatives could include but not be limited to accessible online courses, capture the flag activities (operations), or certification courses outside of CMS.

10) Provide strategic support and consultation to the development and implementation of a plan to incorporate at the enterprise level gamification techniques for all appropriate formal and informal learning activities including upskilling. The plan should leverage tracked data to enhance individual motivation using badges and leaderboards documenting learning trajectories and attained levels of professional competence.

2.2.2 Task Area 2.2: LMS Support

Description of services: The contractor shall assist the course developers by helping load, configure, edit, remove, maintain, and update courses in the LMS, to include addressing LMS configuration and system settings.

1) Creating and configuring the user navigation options, links, and icons.

2) Updating and posting news and latest information on the LMS information pages to provide users information on new course releases, campaigns, deadlines, and course completion requirements.

3) Helping to define and implement the LMS course menu structure of categories and sub-categories of courses.

4) Creating standard course configuration templates for on-line, blended, and instructor based as required.

5) Addressing course issues as browsers are released and require adjustments for proper operation.

6) Update user account fields and data to address user issues.

7) Support enrolling, updating, and removing staff from courses as well as configuring and updating the grade book settings.

8) Generate reports on users and courses as requested to document progress, completions, and other LMS usage.

9) Develop How-To guides to support key LMS functions such as course loading and updating, bulk processes, activity configuration, standard settings, template use, navigation, menu structure, and user updates.

10) Providing technical support to CMS to research, troubleshoot, solve problems, and suggest optimal approaches.

11) Providing on-going LMS training as requested to support to course developers and CMS administrators.

12) Assisting with creation of navigation options, menus, user instructions, email editing, and other facilitation issues.

13) Attending meetings to review issues, document problems, understand and provide input on options and approaches.

14) Work with the CMS personnel to determine adjustments any required LMS updates within LMS capabilities.

15) Provide general LMS assistance and support for course, users, registration, and navigation issues and functionality.

Deliverables: LMS Administrator support to provide:

1) Courses loaded, configured, edited, and maintained a in the LMS.

2) Updated LMS configuration and system settings.

3) Updated navigation options, links, and icons.

4) Current news and latest information on the LMS information pages to provide users information on new course releases, campaigns, deadlines, and course completion requirements.

5) Updated and implemented LMS course menu structure of categories and sub-categories of courses.

6) Course configuration templates for on-line, blended, and instructor based as required.

7) Browser update support

8) Updated user account fields and data to address user issues.

9) Updated staff status from courses as well as configuring and updating the grade book settings.

10) Reports generation for users and courses as requested to document progress, completions, and

11) other LMS usage.

12) How-To guides to support key LMS functions such as course loading and updating, bulk processes, activity configuration, standard settings, template use, navigation, menu structure, and user updates.

13) Trouble-shooting support to CMS to research, troubleshoot, solve problems, and suggest optimal approaches.

14) LMS training as requested to support to course developers and CMS administrators.

15) Updated navigation options, menus, user instructions, email editing, and other facilitation issues.

16) Attending meetings to review issues, document problems, understand and provide input on options and approaches.

17) Adjustments any required LMS updates within LMS capabilities.

18) General LMS assistance and support for course, users, registration, and navigation issues and functionality

2.2.3 Task Area 2.3: CyberVet Training

The Contractor will review the current CyberVet training program (See: https://www.cms.gov/about-cms/careers-cms/cms-cybervets-program#:~:text=The%20CyberVets%20program%20is%20a%20six-month%20rotation%20at,skills%20required%20to%20protect%20our%20data%20and%20network for details); all emerging draft materials; designated learning outcomes, goals, and objectives; and performance measures and metrics. Following the overall review, the Contractor shall provide a framework and strategy for aligning efforts and materials so that there is cohesion within and alignment among the various ISPG training programs. Outcomes should also align to and reference the current version of the NIST NICE framework, considering compliance and levels of maturity in implementing the May 2019, Executive Order on American’s Cybersecurity Workforce, and the Training Modernization Initiative. The Contractor shall develop and implement curriculum using the cognitive apprenticeship learning model and problem-based approach. Training should occur no less than 80% onsite at CMS HQ or other designated location or a blended approach (onsite and virtual) using appropriately designed technology platforms and learning tracking mechanisms. These efforts may include the following activities:

1) Implement the cognitive apprenticeship-based curriculum by facilitating and guiding the CyberVets participants through the curricular learning activities and challenges using a blended approach and implementing the perpetual training model. Actively participate in the further development, evaluation, and refinement of all aspects of the CyberVets program.

2) Provide input and assistance to the government technical lead on all aspects of managing the CyberVets program including agile developmental support and reporting.

3) Using the Kirkpatrick training evaluation model, conduct evaluation activities on the CyberVets program through level 4 as possible and provide formative and summative evaluation reports to ISPG.

a. Conduct after action reviews with the learners to ensure successful implementation of the established educational guidelines.

b. Monitor and provide feedback on the progress and results of both the cohorts and program with recommendations to ISPG.

4) Identify and assess additional training opportunities that support ISPG CyberVet training objectives, both internally and externally and manage their implementation within the CyberVets program as required.

5) Develop and manage the internal CMS employee integration with the CyberVets program as part of Training Modernization.

6) Contribute subject matter expertise in developing innovative and engaging training materials and challenges.

https://www.cms.gov/about-cms/careers-cms/cms-cybervets-program#:%7E:text=The%20CyberVets%20program%20is%20a%20six-month%20rotation%20at,skills%20required%20to%20protect%20our%20data%20and%20network https://www.cms.gov/about-cms/careers-cms/cms-cybervets-program#:%7E:text=The%20CyberVets%20program%20is%20a%20six-month%20rotation%20at,skills%20required%20to%20protect%20our%20data%20and%20network https://www.cms.gov/about-cms/careers-cms/cms-cybervets-program#:%7E:text=The%20CyberVets%20program%20is%20a%20six-month%20rotation%20at,skills%20required%20to%20protect%20our%20data%20and%20network

7) Provide classroom/webinar-based training to support cybersecurity and privacy topics.

8) Conduct cognitive task analysis to produce knowledge and task domain structures as needed.

9) Develop computer-based tasks (challenges) to facilitate deep learning of operational cyber security concepts.

10) Identify high level learning outcomes and develop terminal learning objectives based on the CMS Office of Human Capital identified KSAs from the NICE framework for various job roles within CMS.

11) Provide guidance to learners including directing them to proper resources.

12) Provide mentoring and guidance to participants for transitioning support into the civilian workforce.

13) Report learner progress including recommendations for alterations in the educational guidelines to facilitate continuous improvement.

14) Identify and report key performance indicators, measures, and metrics related to periodic course and learning objectives aligned to organizational outcomes.

15) Support collection and reporting of real-time metrics related to computer-based tasks (challenges).

16) Develop scenarios, problems and exercises for the course's outstanding modules not yet developed, as needed.

17) As needed, identify and book cyber security professionals to be brought in as guest lecturers.

18) Provide feedback and support for future iterations of the CyberVet program.

19) Continue to develop and refined the overall mentorship approach and activities for participants as they acculturate to the CMS context.

20) Continue to refine the participant on-boarding and off-boarding processes and standard operating procedures.

21) Continue to maintain as well as evolve the description and specifications for a current technological learning environment footprint as needed.

22) Provide periodic program updates and presentation to OIT/ISPG leadership as required.

23) Develop and present CyberVets program promotional and marketing materials.

24) Coordinate with and manage external certification programs.

25) Coordinate program needs and CMS requirements with other CMS organizations as required.

26) Provide all necessary licenses for the CyberVets training platform.

27) Promote the CyberVets program through presenting the program at relevant conferences and contributing to academic and professional journals.

28) Participate and guide the CyberVets program’s strategic direction and future requirements from internal and external sources.

29) Provide subject matter expertise in understanding and working with the DoD and, specifically the Skillbridge and Transition Assistance programs

30) Provide mentorship and guidance for active-duty military to successfully transition to the civilian cybersecurity workforce

31) Provide strategic guidance for continuing to evolve, scale, and innovate the learning model and future direction of the CyberVets program

32) Provide or support executive level communications and briefings concerning the overall program status, evolution, and direction.

33) Manage the internal training components of the program in terms of learner registration and scheduling.

34) Provide program metrics and reports as needed to the DoD, CMS, and other designated entities.

35) Provide support to any program management functions necessary to support the creation and/or operation of a CyberVets Program Management Office (PMO).

36) Provide strategic and tactical support to the creation and management of a CMS CyberVets Center of Excellence.

37) Provide strategic and tactical support to the creation and management of CyberVets as a Service (CVaaS).

2.2.4 ** Optional Task ** Task Area 2.4: Content Development Services

The Contractor shall provide expert training content development and delivery services. The training and awareness support task activities for security and privacy include, but are not limited to:

1) Utilize classroom/webinar-based training venues for cybersecurity and privacy topic delivery,

2) Use of security and privacy policy changes and new or changing legislative mandates to update the existing security and privacy training awareness training materials. Changes and updates to material content will be provided to the Contractor by CMS. Changes may occur at a minimum annually and at a maximum quarterly,

3) Based on customer needs and use maintain, update, and deliver training material in various formats including but not limited to; Word, PowerPoint, SCORM compliant training, web-based, and video formats,

4) Utilize courseware creation software such as Adobe Captivate for rapid development of training material,

5) Evaluate existing trainings and curriculum for healthcare Executives who are a major target for credential harvesting scams, and make recommendations for an Executive training program at CMS, prior to creating the training program,

6) Develop and provide training curricula and outreach initiatives regarding security and privacy to CMS employees,

7) Develop insider threat awareness training to include annual role-based training and outreach efforts as needed,

8) Develop breach and Incident Response materials for the purpose of training and education, to include tabletop exercises, checklists, CMS specific breach response planning,

9) Develop defense-oriented technical training covering topics around secure application development such as secure coding, threat modeling, cloud native secure architecture, etc.

10) Provide monthly reporting to ISPG on the status of training activities and project support,

11) Quarterly briefing to ISPG leadership on training outcomes and planning,

12) Provide accomplishment report of Security and Privacy Awareness and Training services provided – Monthly,

13) Training Report for Cleared Employees – Top Secret and below one week after award,

14) Training Report for Cleared Employees – Top Secret and below – Quarterly,

15) Ensure all content developed complies with applicable areas including Section 504 and Section 508 of the Rehabilitation Act prior to use or release.

2.2.5 ** Optional Task ** Task Area 2.5: Information Security and Privacy Awareness Training

CMS requires subject matter expert support for the development, delivery and maintenance of a comprehensive information security and privacy awareness and training program. This program will include, but is not limited to, providing support in the following areas:

1) Assess and provide recommendations of the existing training program and materials.

2) Develop, deliver, and maintain outreach and marketing strategy for security and privacy.

3) Engage with the ISSO and Data Guardian community to communicate changes to ISPG programs. Support ISSO and Data Guardian Engagement and Outreach efforts.

4) Enhance, document, administer, and deliver a comprehensive program to measure and improve the information security and privacy awareness and vigilance of CMS system users, including those with significant security and / or privacy responsibilities.

5) Leverage existing CMS Computer Based Training System (CBT)/LMS for reporting and tracking activities for information security and privacy awareness and role-based training.

6) Provide information security and privacy training (classroom, web-based, and other methods) across the gamut of information security and privacy areas, including CMS security and privacy specific topics and recent industry trends.

7) Provide recommendations for the development, implementation, refreshing and tracking of role-based information security and privacy training.

8) Record training webinars for use at later times.

9) Provide support to the coordination of training seminars, training meetings, conferences, etc.

10) Develop and produce training materials such as 1 pagers, slick sheets, and presentation materials that supports the administration of a comprehensive training program.

Material developed for training may be in the form of, but are not limited to, audio, visual, computer-based, Web-based, or written media as directed by CMS. The Contractor may be required to provide instructors to present any of the material developed in the form of (but not limited to) classroom instruction, small group discussions, briefings, etc., as directed by CMS. The ability to allow courses to be captured electronically for use by personnel who cannot attend the training in person should be available.

In addition, the Contractor shall develop and provide courses in other formats, including (but not limited to) webinars, avatar, PowerPoint presentations, etc. CMS will determine the distribution of the type of training to be provided with input from the Contractor.

The Contractor shall develop the following material for each class as necessary:

1) For classroom training:

a. Student handout that contains a copy of the course briefing and/or other supporting material

b. A copy of the course briefing and/or other supporting material archived to CMS

SharePoint training folder

2) For all courses:

a. Course evaluation to be completed by each individual attending the class.

b. Certificate of Attendance to be awarded to each individual completing the class.

c. Proficiency examination that will be administered by the Contractor at the conclusion of each class, if warranted by the content.

d. Certificate of Accomplishment for individuals successfully completing the examination.

If appropriate, this certificate may be in the form of a Committee for National Security Systems (CNSS) or other Government- recognized certification.

e. Maintain electronic copy (e.g., Acrobat file) of the scanned image of completed course evaluations in the LMS.

f. Maintain attendance files in the CBT or LMS as appropriate.

g. Trainings are made Section 508 compliant.

In addition to training, the Contractor shall develop and execute an outreach and marketing campaign for integration of ISPG services by CMS programs. The Contractor shall develop a strategy. Once the government approves the strategy, the Contractor shall execute the strategy. Additionally, the Contractor shall develop all materials to include brochures and slick sheets, however, delivery will be in electronic format only. The Contractor shall also conduct outreach activities such as brown bags and displays as approved by the GTL.

2.2.6 **Optional Task** Task Area 2.6: Internal Staff Training Program Support

The Contractor shall develop and implement curriculum using the cognitive apprenticeship learning model no less than 80% onsite at CMS HQ or other designated location:

1) Conduct cognitive task analysis to produced knowledge and task domain structure.

2) Develop computer-based tasks (challenges) to facilitate deep learning of operational cyber security concepts.

3) Develop terminal learning objectives based on the CMS Office of Human Capital identified KSAs from the NICE framework for various job roles within CMS.

4) Provide guidance to learners including directing them to proper resources.

5) Conduct after action reviews with the learners to ensure successful implementation of the established educational guidelines.

6) Report learner progress including recommendations for alterations in the educational guidelines to facilitate continuous improvement.

7) Identify and report key performance indicators related to periodic course and learning objectives.

8) Support collection and reporting of real-time metrics related to computer-based tasks (challenges).

9) Develop scenarios, problems and exercises for the course's outstanding modules not yet developed, as needed.

10) As needed, identify and book cyber security professionals to be brought in as guest lecturers.

11) Provide feedback and support for future iterations of the internal staff training support.

12) Provide support to other CMS Cyber Security training including, but not limited to Cyber Veterans Cyber Risk Advisor and Information System Security Officer (ISSO) training.

13) Provide all necessary licenses for the training platform.

2.2.7 Task Area 2.7: Training Requirements for Cleared Employees

Training for Cleared Employees (Top Secret and below):

The contractor shall provide comprehensive training and training materials. The training shall be conducted in the Baltimore, Maryland, area. Training and materials shall include, but not be limited to, the following:

1) Customer support:

a. History and derivation of any systems

b. CMS Information Security Policy

c. Security Operations Center Procedures

d. Authority to Operate Review Process

e. Standard Operating Procedures

f. Quality assurance procedures

g. System documentation

h. User documentation; and,

i. Continuity of operations.

Training Requirements for Cleared Employees:

The Facility Security Officer (FSO) must ensure cleared employees (Top Secret and below) complete required training below prior to performing work on this CMS contract. This training is in addition to the required company training for employees with a security clearance.

1) Employees that will produce classified documents and/or access classified systems:

DSS/CDSE Courses

Derivative Classification Course and Exam

Hours

2.5 hours

Course #

IF103.16

Exam #

IF103.06

Remarks

Every 2 years

Introduction to Information Security Course and Exam

3 hours IF011.16 IF011.06 One time

Marking Classified Information Course and Exam

2 hours IF105.16 IF105.06 One time

Unauthorized Disclosure of Classified Information Course and Exam

2 hours IF130.16 IF130.06 One time

2) The Contract Officer Representative (COR) and/or Government Technical Representative (GTR) will ensure the following training is completed by all individuals during the first week of work at CMS:

CMS Security Training

CI, Insider Threat, Cyber Security/Threat

Hours

1.5 hours

Remarks

LMS - Annually

Review the NSI Policy and Handbook

1 hour Intranet – One time

Review the Secure Space

SOP

1 hour Employees working in the Secure Space – One time

a. The information identified above is not all inclusive. Additional training may be required, depending on the level of security clearance and access to classified systems.

b. The Contractor will be required to submit a Training Report for Cleared Employees to the COR after the first week of the contract to ensure all employees have completed their training. Thereafter a Quarterly Training Report will be required.

c. If the Contractor is following NISPOM guidance, then they will not be required to complete all the training listed above, instead those personnel accessing classified systems will be required to review CMS guidance (e.g., NSI Policy and Handbook, and Secure Space SOP) and complete any additional training required for accessing and handling classified information.

2.2.8 **Optional Task** Task Area 2.8: Live Application Security Training Support

The Contractor shall develop or partner with industry instructors to create and deliver hands-on defense-oriented security training focused on secure application development that:

1) Occurs in a classroom setting (live and/or virtual) anywhere from 4-6 times per year.

2) Covers advanced secure application development topics such as: secure software development, threat modeling, cloud native security architecture, DevSecOps, etc.

3) Incorporates hands-on exercises to reinforce course content

2.2.9 Assumptions, SLAs, and Operating Constraints

1) All system software developed must use CMS standard application development tools, including Visual Studio, SQL Server, and Adobe development tools.

2) Classroom training and outreach will be conducted at the CMS Single Site, in Baltimore, MD.

Attendees could be remote, and the Contractor may need to work across US time zones.

3) All meetings shall take place at the CMS Single Site, in Baltimore MD or via approved virtual technologies.

4) The Government shall provide the room/space for all meetings.

5) Training shall be all-encompassing (including the cost of all course material and assembly).

6) The Contractor shall make sure any documents or updates to documents have gone through a quality control check for spelling, grammar, and formatting errors before submission to CMS.

7) As required, during each calendar year the Contractor will conducted 2 - 3 in person and/or remote classes per month. Examples include Cybersecurity Essentials, Risk Management, Contingency Planning and Assessment & Authorization.

8) The Contractor shall conduct brown bag seminars on various ISPG topics monthly, as required.

9) Training team must maintain an average feedback rating at or above 8.5 out of 10 on Course Evaluation forms.

10) Trainer must have at least 5-years’ experience developing course content and providing training.

3 Contract Management Requirements

3.1 Project Status Meetings

Weekly Status Meetings

Weekly Project Status Meetings shall be conducted by the Contractor for the GTL and or task GTLs and the technical support team. Meetings will be held weekly, at a minimum. The meetings will be held either via conference call or at a location designated by CMS. At these meetings, the Contractor shall provide a progress review of the current and upcoming tasks as well as any issues or risks.

Monthly Status Meetings

Monthly Project Status Meetings shall be conducted among the Contractor, and the Contracting Officer’s Representative (COR) and GTL. Other CMS stakeholders may be invited to attend at the COR’s discretion. Meetings will be held monthly, at a minimum, and may be more frequent at the COR’s discretion. The meetings will be held at a location designated by CMS. At these meetings, the Contractor shall provide a progress review of the tasks listed above.

The progress review shall include:

1) Status of any SLAs (if applicable)

2) An overview of the financial status, using the CMS supplied financial status report template

3) A discussion of issues and risk

4) A discussion of items delayed/not on schedule

5) Current and upcoming contract actions

6) Performance feedback which should be tracked on a rolling basis

The Contractor shall prepare and submit an agenda two (2) business days prior to each meeting and prepare and provide minutes of each meeting within 24 hours after the meeting. The meeting minutes, at a minimum, shall include the following:

1) List of participants

2) Purpose of the meeting

3) Decisions reached during the meeting

4) Action items identified (including the person responsible for addressing the action and the date the action is to be completed)

5) Date, time, and location of next meeting

3.2 Key Personnel

All proposed substitutions of key personnel shall be submitted, in writing, to CMS at least 30 days prior to the proposed substitution, or as soon as reasonably known. Each request shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume, and any other information required by CMS. All proposed substitutions shall have qualifications equal to or greater than the person(s) being replaced. Key Personnel:

• Program/Project Manager

• Senior Education/trainer Subject Matter Expert

3.3 Deliverables

The Contractor shall ensure the timeliness and quality of the deliverables for the individual tasks.