Atch 1 PWS 23RCN15 NC Mexico Specialized Cyber Defense Training.pdf

ACC AMIC

COUNTER NARCOTICS AND GLOBAL THREATS (CN&GT)

NORTHCOM – SPECIALIZED CYBER DEFENSE TRAINING

PERFORMANCE WORK STATEMENT (PWS)

14 June 2023

DRAFT

NORTHCOM – SPECIALIZED CYBER DEFENSE TRAINING PWS

1.0 MISSION OBJECTIVE

This contract will support all organizations supporting or supported by DoD, Deputy Assistant

Secretary of Defense CN & Stabilization Policy (DASD CN/SP), Defense Security

Cooperation Agency (DSCA), Service Components, CCMDs, Major Commands, and subordinate organizations to meet national defense strategies and objectives. Summaries of relevant missions include, but are not limited to, CN, Counter-Illicit Drug Trafficking

(CIDT), Counter- Transnational Organized Crime/Criminal Networks (CTOC), Counter

Terrorism (CT), Maritime and Border Security (MBS), Counter-Threat Finance/Illicit Finance

Activities (CTF), Detection & Monitoring (D&M), Military Intelligence Operations/Cyber

Operations, Counter-Weapons of Mass Destruction (CWMD), and Security Cooperation

(SC), BPC. Primary statutory authority for this effort is 10 U.S.C. § 333, Foreign Security

Forces – Authority to Build Capacity, but may be subsequently amended, revised, or added/deleted to meet existing national defense strategies and objectives, as noted herein:

2.0 SCOPE

The contract scope is to provide specialized cyber defense training to the Mexican military. The training will equip the Mexican military with the knowledge, skills, and abilities necessary to defend network infrastructure, detect cyber intrusions, identify hacker techniques, counter cyber-attacks, and (once an attack is detected) react quickly and effectively performing computer forensics for investigation and analysis.

3.0 PERFORMANCE REQUIREMENTS

The Contractor shall provide all qualified personnel, courseware, equipment, materials, other resources, and necessary Plans of Instruction (POI) with associated course material to conduct the following four (4) training courses (per contract year) for the Mexican military, conducted at Government of Mexico (GOM) provided facilities:

• Building and Leading Security Operations Centers

• Network Monitoring and Threat Detection In-Depth

• Advanced Incident Response, Threat Hunting, and Digital Forensics

• Security Information and Event Management (SIEM) with Tactical Analytics

3.1.1 All training shall be conducted in Latin American Spanish with onsite instruction at a

GOM facility for each course. Additionally, all training courses shall be no more than five (5) consecutive days, 40 hours in duration, eight (8) hours a day. None of these training courses require a specific student to instructor ratio.

3.1.2 The proposed phasing, instruction methodology and determination of instructional materials are the responsibility of the Contractor. The course material shall include a training syllabus, all presentation slides, handouts, and reference material used to teach each individual course.

3.1.3 The Contractor shall provide Plan of Instructions (POI) and Course Materials in English and Latin American Spanish, to the USG for review and approval NLT 30 calendar days prior to the class start date. The USG will provide feedback and/or approval within 14 calendar days from receipt. The Contractor shall deliver the final POI and Course Materials 10 calendar days prior to training to the USG electronically (email). Additionally, a hard copy (paper) shall be provided in Latin American Spanish, on the first day of training to each student.

3.1.4 At a minimum, the POIs and Course Material shall address the following:

• Course description

• Course administration

• Course-level and topic-level learning objectives

• Instructional methods

• Student assessment methodology

• Student documentation

3.1.5 Training shall be taught by certified cyber security instructor(s), in Latin American

Spanish language IAW PWS 6.1.

Building and Leading Security Operations Centers (SOC)

3.2.1 The contractor shall provide a Building and Leading Security Operations Centers (SOC) course for up to 10 Mexican Military students in a GOM laboratory environment facility.

3.2.2 POI for Advanced Cyber Security Training shall include:

3.2.2.1 Building, training, and empowering a diverse SOC team.

3.2.2.2 Creating playbooks and managing detection use cases.

3.2.2.3 Using threat intelligence to focus detection efforts.

3.2.2.4 Threat hunting and active defense strategies.

3.2.2.5 Implementing efficient alert triage and investigation workflow.

3.2.2.6 Effective incident response planning and execution.

3.2.2.7 Choosing metrics and long-term strategy to improve a SOC.

3.2.2.8 Team member training, retention, and advancement.

3.2.2.9 Collecting the most important logs and network data.

3.2.2.10 SOC assessment through capacity planning, purple team testing, and adversary emulation procedures to ensure network cybersecurity is constantly improved to prevent cyber-attacks and so that detection of breeches is swift and responded to in an appropriate manner.

3.2.3 Hands on Training will include:

3.2.3.1 Threat actor assessment and attack path development.

3.2.3.2 Attack tree assessment, visualizing attack techniques and security controls.

3.2.3.3 SOC capacity planning and planning a threat hunt.

3.2.3.4 Planning incident response.

3.2.3.5 Building a skills self-assessment and training plan.

3.2.3.6 Purple team assessment.

3.2.3.7 Creating, classifying, and communicating security metrics.

Network Monitoring and Threat Detection In-Depth

3.3.1 The Contractor shall provide a Network Monitoring and Threat Detection in Depth training course for up to ten (10) Mexican military students in a GOM laboratory environment facility.

3.3.2 The POI and Course Materials for Network Monitoring and Threat Detection in Depth shall include:

3.3.2.1 How to analyze traffic traversing networks.

3.3.2.2 Identifying zero-day threats for which no monitoring tool has published signatures.

3.3.2.3 How to configure and tune network monitoring for maximum detection.

3.3.2.4 Reconstructing events to determine what happened, when, and who is responsible.

3.3.2.5 Hands-on detection, analysis, and network forensic investigation with various tools.

3.3.2.6 Using Transmission Control Protocol/Internet Protocol (TCP/IP) and common application protocols to distinguish normal from abnormal traffic.

3.3.2.7 Types and use of behavioral network monitoring tools for enterprise-wide automated correlation.

3.3.2.8 Performing effective threat modeling for network activities.

3.3.3 Hands on Training will include:

3.3.3.1 Wireshark configuration and operation.

3.3.3.2 Writing TCP dump Filters.

3.3.3.3 Setting up effective Snort rules.

3.3.3.4 IDS/IPS Evasion Theory.

3.3.3.5 Analysis of Incident Scenarios.

Advanced Incident Response, Threat Hunting, and Digital Forensics

3.4.1 The Contractor shall provide an Advanced Incident Response, Threat Hunting, and

Digital Forensics training course for up to ten (10) Mexican military students in a GOM laboratory environment facility.

3.4.2 The POI and Course Materials for Advanced Incident Response, Threat Hunting, and

Digital Forensics shall include:

3.4.2.1 Understanding attacker tradecraft to perform compromise assessments.

3.4.2.2 Detecting how and when a breach occurred.

3.4.2.3 Identifying compromised and infected systems.

3.4.2.4 Performing damage assessments and determine what was read, stolen, or changed.

3.4.2.5 Containing and remediating incidents of all types.

3.4.2.6 Tracking adversaries and developing threat intelligence to scope a network.

3.4.2.7 Hunting down additional breaches using knowledge of the adversary.

3.4.2.8 Building advanced forensics skills to counter anti-forensics and data hiding from technical subjects.

3.4.3 Hands on Training will include:

3.4.3.1 Using tools, techniques, and procedures to hunt, detect, and contain adversaries and remediate incidents.

3.4.3.2 Detecting and hunting unknown live, dormant, and custom malware in memory across Windows systems.

3.4.3.3 Hunting through and performing incident response across systems using open source tools.

3.4.3.4 Identifying and tracking malware beaconing via memory forensics, registry analysis, and network connection residue.

3.4.3.5 Targeting adversary anti-forensics techniques used to move in the network and maintain an attacker's presence.

3.4.3.6 Using memory analysis, incident response, and threat hunting tools to detect hidden processes, malware, attacker command lines, rootkits, network connections.

3.4.3.7 Identifying lateral movement and pivots within the enterprise across endpoints.

3.4.3.8 Tracking data movement as attackers collect critical data and shift to exfiltration collection points.

Security Information and Event Management (SIEM) with Tactical Analytics

3.5.1 The Contractor shall provide a SIEM training course for up to ten (10) Mexican military students in a GOM laboratory environment facility.

3.5.2 The POI and Course Materials for SIEM and Tactical Analytics shall include:

3.5.2.1 SIEM use, open-source tools, architecture, and best practices.

3.5.2.2 Understanding data sources to collect logs from and deploying scalable logs with multiple ways to retrieve logs.

3.5.2.3 Operationalizing ordinary logs into tactical data.

3.5.2.4 Developing graphs and tables used to detect adversary activities and abnormalities.

3.5.2.5 Building dashboards that make analyst review more tactical.

3.5.2.6 Developing baselines of network activity based on users and devices.

3.5.2.7 Developing baselines of operating systems with the ability to detect changes from the baseline.

3.5.2.8 Correlating and combining multiple data sources to achieve more complete analysis.

3.5.2.9 Providing context to alerts to help understand and prioritize them.

3.5.2.10 Using log data to build security control effectiveness.

3.5.2.11 Implementing log alerts that support breach detection.

3.5.3 Hands on Training will include:

3.5.3.1 Log collection.

3.5.3.2 Log augmentation and enrichment.

3.5.3.3 Windows log analysis.

3.5.3.4 System and network baseline

Projected Course Schedule:

• Building and Leading SOCs (Second or Third Quarter FY)

• Network Monitoring and Threat Detection In-Depth (Second or Third Quarter FY)

• Advanced Incident Response, Threat Hunting, and Digital Forensics (Third Quarter FY)

• Security Information and Event Management (SIEM) with Tactical Analytics (Fourth

Quarter FY) o Note: The projected schedule is notional. Ultimately, timing of course execution and delivery shall be at the discretion of the USG.

Training Location Standards

3.7.1 All training will be held in a GOM provided facility. The USG will provide facility information, to include the physical address, and training location to the contractor point of contact (POC), no later than 45 calendar days prior to the start of training.

3.7.2 The GOM provided facility shall provide a laboratory environment training facility that can accommodate lessons, lectures, demonstrations, tutorials, and laboratory work. The facility will accommodate the required number of students, ample room and connectivity for all training materials (i.e., projection screens, white boards) and all information technology requirements

(student computers, servers, local area network, electrical outlets, internet connectivity, Wi-Fi capability).

3.7.3 Additionally, the Contractor shall provide the following capability/resources/information:

3.7.3.1 All security related tools/devices (i.e., VMware, Wireshark, Android, Linux, Windows, Active Directory, etc.), that the POI requires.

3.7.3.2 Training conducted in Latin American Spanish.

3.7.3.3 Required configurations for student computers to the USG NLT 30 calendar days prior to the class start date.

Country Specific Requirements:

3.8.1 The Contractor shall ensure all employees meet country clearance requirements no later than thirty days prior to each course occurring in Mexico. This includes APACs Country clearance processing through USG and signed US Department of State Regional Security Officer

(RSO) Force Protection Acknowledgement forms provided to the Contractor by USG. If threat conditions change, the USG will provide updated country clearance requirements during the

Contract Kickoff Meeting.

3.8.2 The Relations with Host Country. In the interest of assuring and maintaining the highest order of foreign and diplomatic relations in the host country, the Contractor is enjoined from having any direct or indirect negotiations, dealings, agreements, business or entreaties with officials of the host government, which would have a direct or indirect effect upon accomplishing or performing on this contract, and which could be construed by the host government or host country citizens as having been officially or unofficially sanctioned, approved or constructively condoned by the U.S. Government. Contacts by the Contractor relating to this requirement shall be through appropriate U.S. Government channels as prescribed by the CO. Specifically excluded from the prohibition herein set forth is the incidental daily contacts of the Contractor or his employees, which they may reasonably be expected to have in the normal course of travel, daily work, labor disputes, customs clearances, and passport control.

4.0 PERFORMANCE SCHEDULE AND LOCATION

Performance Schedule. The period of performance (PoP) shall be 365 calendar days after receipt of order for the base year and 365 calendar days for up to 3 option years, if exercised. Specific dates will be documented in the contract upon award.

Work Hours. The Contractor shall provide the appropriate labor hours to meet the requirements of the PWS and accommodate training consistent with the durations prescribed in the PWS. Planned course duration is five (5) consecutive days, 40 hours in duration, eight (8) hours a day. The Contractor shall also be prepared to provide an additional two (2) hours of human rights training IAW 6.10, if requested.

Places of Performance. The principal places of performance shall be conducted at a

GOM facility in Mexico City, Mexico.

5.0 TEMPORARY DUTY TRAVEL (TDY)

General. The contractor shall perform travel, as required in the performance of this effort. The contractor shall provide all transportation, lodging, and meals for contract personnel travelers. The Contractor shall coordinate all travel with the Program Manager

(PM)/Contracting Officer Representative (COR). Appendix B, Travel Approval Worksheet shall be used to obtain travel approval and/or notification. The Contractor shall ensure that all (on foreign soil only, verify with COR or Travel Coordinator) employees are loaded into the

Synchronized Pre-deployment and Operational Tracker (SPOT) database, if applicable, and have a current DD Form 93, Record of Emergency Data Card, on file with the Contractor. The

Contractor shall ensure that all OCONUS travelers have a country approval to enter the country for this mission as well as a Letter of Authorization (LOA) approved by the Contracting Officer

(CO) prior to travel. Travel requires PM/COR approval prior to country clearance and SPOT submittal (OCONUS).

Life Support. As applicable, the contractor shall be responsible for providing life support services, Defense Base Act (DBA) insurance, and security for personnel performing work in Mexico.

Foreign Clearance Guide (FCG). The Contractor shall ensure that all requirements for foreign travel, as specified in the Department of Defense (DoD) FCG, currently at https://www.fcg.pentagon.mil/fcg.cfm, are met prior to traveling to work locations OCONUS. As part of FCG compliance, travel to some countries required medical and/or emergency evaluation from that country (may include proof of Medical Evacuation insurance for country of travel).

Travel to locations other than those specified in this D/O requires prior written approval of the responsible CO.

Synchronized Pre-deployment and Operational Tracker (SPOT). OCONUS travel cannot occur without an approved SPOT request. The contractor shall submit a travel request

(Paragraph 9.7) and obtain pre-approval from the COR or PM prior to requesting a SPOT Letter of Authorization (LOA) and performing any travel. The contractor shall ensure that all employees are loaded into the SPOT database and have a current DD Form 93 and Record of

Emergency Data Card on file with the Contractor. Submit all SPOT requests to the COR and

CO.

Aircraft and Personnel Automated Clearance System (APACS)/Country Clearance

Requests. OCONUS travel cannot occur without an approved APACS/Country Clearance request. The Contractor is solely responsible for screening all contractor and subcontractor personnel performing in-country under this contract. The contractor shall submit APACS request no less than the lead-time from the FCG plus five business days for CNGT processing. All contractor personnel must be able to provide requisite documents and credentials in support of

APACS request and must be able to fully obtain access to applicable HN facilities or U.S

Embassy facilities/Approved Vendors List, as required. DOD contractors shall travel under business or tourist status.

Visa/Passport Requirements. It is the contractor's responsibility to ensure personnel traveling to the Mexico have a valid US passport.

6.0 OTHER REQUIREMENTS.

Personnel Requirements/Qualifications

6.1.1.1 The Project Manager is identified as key personnel and shall meet the following qualifications requirements: Minimum of bachelor’s degree in business- or business-related disciplines and three (3) years of experience in project management applications; OR six (6) years of experience in project management applications.

6.1.1.2 The Contractor shall inform the CO whenever changes in personnel are anticipated.

The Contractor shall provide resumes with documented evidence of personnel qualifications to the CO for review and approval. Vacancies shall not exceed 14 calendar days from start of vacancy to request for CO acceptance of replacement, unless otherwise approved in writing or directed in advance by the CO.

6.1.1.3 Course Instructor(s) shall meet the following qualifications requirements:

Interagency Language Roundtable Level 4 (Advanced Professional Proficiency) certified in

Latin American Spanish. Instructor(s) shall be licensed, registered or otherwise certified in area of expertise (i.e. Security Operations, Incident Handling Management, Detection and Intrusion

Analysis, Network and Computer Forensic Analysis), and have a minimum of three (3) years of experience for cyber security instruction and course planning. Instructor(s) shall have qualifying certification for the specific area course being taught to include: CISSP or CompTIA

Security+. Additional certifications (i.e. CISA, CEH, ECSA, CWSP, GNFA, GASF, GCFA, GCFE, etc.), should reflect specific area course expertise.

6.1.1.4 No later than 30 calendar days prior to training, the Contractor shall provide the

USG with the full name of the instructor(s) to include resumes with documented evidence of personnel qualifications to the CO and PM for review and concurrence.

Contractor Communication

6.2.1 All Contractor personnel shall communicate professionally and only with respect to contract business concerns with non-acquisition personnel. All contract information and communication shall flow through and be provided to the CO, PM and/or COR, as applicable, to affect appropriate contract action and address in-country issues. Only the CO, PM and/or COR or officially designated representative, will report and communicate contract performance status with other the US Government (USG) personnel and USG management chains.

Issue Resolution. The Contractor shall monitor and report all situations that could cause delays in performance or unsuccessful contract performance.

USG Presence at Training Events. The Contractor shall allow the USG access to the training event for the purpose of observation and to ensure training is in accordance with PWS specifications. The USG attendees may include customer representatives and/or program office/quality assurance observers.

Meetings

6.5.1 Kick-off Meeting. The Contractor shall participate in a kick-off meeting to be coordinated and conducted by the USG within ten (10) business days of contract award. The method of the meeting will be determined by the USG but primary medium will be virtual unless told otherwise.

6.5.2 Status Meetings. The Contractor shall participate in monthly status meetings (or other contract-related meetings), scheduled upon request of the PM/COR/CO, to formally or informally discuss or review the Contractor’s efforts, accomplishments, and progress toward contract completion. During the meetings, the Contractor shall present necessary data to enable a joint review of its various assigned tasks, schedules, and resource expenditures. The Contractor shall present and participate in discussions and shall inform the USG of any issues with contract execution and provide proposed solutions.

6.5.3 Other Meetings. The Contractor shall attend and participate in other meetings, as scheduled by the CO or written designee.

Contractor Furnished Supplies, Equipment, and Services.

6.6.1 No later than 30 calendar days prior to training, the contractor shall provide the USG a list of contractors furnished training equipment and/or aids that will be brought into Mexico for training use. The list shall include item description, quantity, make, model, and serial number.

While it is not mandatory, photographs of the equipment have proven beneficial. This list is required for USG coordination with the U.S. Embassy and Mexican Customs to facilitate customs clearance processes.

Contractor Identification. Each Contractor employee shall, while on duty, wear in plain view on the upper portion of his/her outer garment a metal or plastic identification badge to be furnished by the Contractor, containing the company name, employee name, and the section where the employee works. Contractor employees shall clearly identify themselves as

“Contractors” at all times, in all communications and representations, including in the workplace, at meetings, in conversations, telecommunications, mail, electronic mail (e-mail), and faxes, whether with USG personnel, other Contractor personnel, or with the public.

Arms Export Control Act and ITAR. The Contractor shall be responsible for all aspects of export compliance IAW the Export Administration Regulations (EAR), ITAR, and

Arms Export Control Act. Export licenses and International Traffic in Arms Regulation (ITAR) compliance are required by the freight forwarders to export equipment to Mexico; therefore, the contractor shall be responsible for ITAR and export compliance. The Contractor shall register with the Directorate of Defense Trade Controls (DDTC) and obtain all required licensing and licensing agreements for all items exported that are included on the US Munitions List (USML).

The Contractor shall ensure the proper forms and documentation are used and accurate prior to the export of all material and technology identified in this D/O. Designated ITAR controlled articles shall be controlled by the contractor and marked at the vendor level and shipped to the

POD with all documentation ready for USG review. If applicable, the Contractor’s schedule shall plan for at least 30 calendar days (after delivery of documentation to the USG) for completion of required EU signatures on ITAR-required documentation. EU documentation shall be provided for each POD (as an example, SEDENA and SEMAR are different EU and have different point of delivery locations; separate and provide only applicable ITAR documentation for each EU).

Technical Assistance Agreements (TAA). The Contractor shall ensure the appropriate

TAAs and/or applicable export licenses are in place before conducting any activity under this contract that requires such approval and documentation.

Defense Institute of International Legal Studies (DIILS) Human Rights training and certification. The program will include required elements to promote observance of and respect for the law of armed conflict, rule of law and human rights and fundamental freedoms and respect for legitimate civilian authority within the country. Each training event conducted will include, at a minimum, two (2) hours of DILLS-prepared training on the topic of human rights and international law. The Contractor shall present this DILLS-prepared training at the commencement of the training or course (first topic). The USG will provide course materials necessary to meet this requirement. The Contractor shall coordinate with the USG to ensure any tailored requirements or special areas of concern are addressed. Following the delivery of this course, the Contractor shall complete the DIILS Certification Memorandum with the signature, printed name, rank/grade (if applicable), and unit of assignment of the training provider, as well as the name of the unit trained, date of training and training roster attached, and provide the completed memorandum to the USG CO, PM, and COR.

7.0 GOVERNMENT FURNISHED SUPPORT

Human Rights Vetting. The Government is responsible for ensuring all required human rights vetting is completed before the Contractor provides any training, equipment, services, or assistance to foreign personnel.

Government-Furnished Equipment/Facilities/Information (GFE, GFF, GFI).

7.2.1 For training that occurs in Mexico City, Mexico at a GOM facility, USNORTHCOM and the Office of Defense Coordination (ODC), in coordination with the GOM, will:

7.2.1.1 Ensure Contractor personnel have access to required GOM training locations.

7.2.1.2 Ensure the GOM provides adequate workspace/classroom to perform training.

7.2.1.3 Ensure the GOM provides computers for students attending the cybersecurity training, and that computers meet contractor provided minimum technical specifications.

7.2.1.4 Provide printer access/use specifically for printing course certificates.

7.2.1.5 The USG will provide transportation to and from the hotel and the training site.

7.2.1.6 Provide a required Regional Security Officer (RSO) brief that all US personnel must read and sign and return to the USNORTHCOM representative as part of the pre-deployment process.

7.2.1.7 Provide the physical address of the OCONUS training site and training dates to the Contractor no later than 45 calendar days prior to commencement of the training courses for courses conducted on a Mexican military installation.

7.2.2 The USG shall provide a list (electronically) of students, to the Contractor, 10 calendar days prior to the start of the applicable course.

All work performed under this contract shall be at the UNCLASSIFIED level.

8.0 DELIVERABLES

The following are deliverables required by this contract:

Deliverable Details

Plan of Instruction

(English)

(POI)

Reference: PWS 8.1

Due Date: 30 calendar days prior to training

Delivery Method: Electronically (E-mail)

Government Review Time: 14 calendar days

Recipients: Government PM/COR/CO/CM/SETA contractor Support

Plan of Instruction

(Latin American

Spanish)

(POI)

Reference: PWS 8.1.

Due Date: Electronically 10 calendar days prior to training. Physical documents are due concurrent with training.

Delivery Method: Electronically (E-mail), One copy shall be provided to each student at beginning of 1st day of the course

Government Review Time: N/A

Recipients: Government PM/COR/CO/CM/SETA contractor Support

Course Material

(English)

(CME)

Reference: PWS 8.2

Due Date: Electronically 30 calendar days prior to training

Delivery Method: Electronically (E-mail)

Government Review Time: 14 calendar days

Recipients: Government PM/COR/CO/CM/SETA contractor Support

Course Material (Latin

American Spanish)

(CMS)

Reference: PWS Paragraphs 8.2

Due Date: Electronically 10 calendar days prior to training. Physical documents are due concurrent with training.

Delivery Method: (Electronically (E-mail) for reference), one (1) hardcopy per student at beginning (1st day) of the course

Government Review Time: N/A

Recipients: Government PM/COR/CO/CM/SETA contractor Support

Student Computer

Technical Specifications and configurations

(STS)

Reference: PWS Paragraph 8.3

Due Date: Electronically 30 calendar days prior to training.

Delivery Method: Electronically (E-mail)

Updates: The Contractor shall provide any changes or updates within five (5) calendar days of the identification of any required technical specification and/or configuration change to the Government PM/COR/CO for Government review and acceptance prior to Contractor implementation.

Recipients: Government PM/COR/CO/CM/SETA contractor Support

Student Course

Critiques

(SCC)

Reference: PWS Paragraph 8.4

Due Date: Copies of completed student Overall Course Critiques are due within five (5) calendar days.

Delivery Method: Electronically (E-mail)

Government Review Time: N/A

Contractor Resubmittal Time: N/A

Recipients: Government PM/COR/CO/CM/SETA contractor Support

Course Completion

Certificate

(CCC)

Reference: PWS Paragraph 8.5

Due Date: Physical course certificates shall be presented to students upon course completion.

Delivery Method: Physically to each student

Recipients: Students

After Action Report

(AAR)

Reference: PWS Paragraph 8.6

Due Date: Five (5) calendar days after course completion

Delivery Method: Email; one (1) for each training event

Updates: The Contractor shall provide any changes or updates within five (5) calendar days of any change to the schedule to the Government PM/COR/CO for Government review and acceptance prior to Contractor implementation.

Government Review Time: N/A

Recipients: Government PM/COR/CO/CM/SETA contractor Support

Quality Control Plan

Reference: PWS Paragraph 8.7

Due Date: 30 calendar days after contract award

Delivery Method: Electronically (E-mail)

Updates: The Contractor shall provide any changes or updates within 5 calendar days to the Government PM/COR/CO for Government review and acceptance prior to Contractor implementation.

Recipients: Government PM/COR/CO/CM/SETA contractor Support

Plan of Instruction (POI). Provide POI (English) 30 calendar days prior to the training event in English, for USG coordination. Once the POI is approved by the USG after no later than 10 business days. The POI shall be translated to Latin American Spanish and provided to

USG 10 calendar days prior to training. The Latin American Spanish POI shall be provided as physical course material to each student.

Course Material English (CME) and Course Material Spanish (CMS) The

Contractor shall provide CME IAW this PWS in English, for USG review and approval. Once approved by the USG, Course Material for training shall be translated to Latin American

Spanish and provided to each student on the first day of class.

Student Computer Technical Specifications and configurations (STS) The Contractor shall provide to the USG electronically, 30 calendar days prior to training. Additionally, any changes or updates shall be provided within five calendar days of the identification of any required technical specification and/or configuration change to the Government PM/COR/CO for

Government review and acceptance prior to Contractor implementation.

Student Course Critiques (SCC). The Contractor shall provide each student a course critique. The contractor shall provide and administer daily and overall student course critiques in Latin American Spanish. Critiques shall be tailored to each course and translated into

English. At a minimum, course critiques shall consist of the course completed, student name, a three-tier rating for the students to address their overall learning in regard to specific course area, course materials provided, instructor(s) performance, and recommended area(s) of improvement, in a contractor provided template.

8.4.1 The Contractor shall provide an electronic daily Situation Report (SITREP) to the USG prior to the start of the next instruction day.

8.4.2 A copy of each overall course critique shall be provided to the USG no later than five calendar days after course completion.

8.4.3 A copy of each critique shall be provided to the USG at the conclusion of training.

Course Completion Certificates (CCC) Upon successful completion of each course, the Contractor shall provide each student with an individualized Course Completion Certificate in Latin American Spanish.

8.5.1 The certificate shall be presented on the last day of training. Physical course certificates shall be presented to students upon course completion.

8.5.2 A copy of each CCC shall be provided to the USG? within five (5) days upon the conclusion of training course.

Training Event Review Report (TERP) The Contractor shall deliver a Training Event

Review Report no later than five calendar days after each course completion. The report shall contain date of training, instruction location, training type, training overview, training participants, summary, discoveries, corrective actions, action items, observations, and any concerns.

Quality Control Plan (QCP) The QCP shall be tailored to this requirement & PWS and discuss specifically how the prime will address contract oversight. The QCP shall discuss who will conduct the QC, when inspections will be executed, how they will ensure PWS requirements are met and what the processes for corrective actions are. Additionally, it shall discuss the

Invoice QC process: how the prime, subcontractor, and supplier (if applicable) invoice documentation and supporting data will be reviewed for accuracy prior to submitting to USG.

APPENDIX A

SERVICES SUMMARY MATRIX

Performance

Objective Performance Standard Performance Threshold

Training No training courses are delayed due to availability of services

Performance is acceptable when:

a) POIs and Course Material are received within required timelines.

b) Training meets all required topics and instructional requirements.

c) Problems related to training encountered are minor and resolved in a satisfactory manner.

d) No more than 2 customer complaints per class; complaints must be assessed as valid by USG.

e) Meet programmed graduation dates.

Deliverables

Management

Develop and Submit Deliverables Performance is acceptable when:

a) 100% of deliverable requirements are met and received on time, and information is current and accurate.

*Non-current or inaccurate deliverables (or those with conflicting information) may be considered late. 100% of deliverable requirements are met with no more than one late or rejected deliverable per course.

APPENDIX B

TRAVEL APPROVAL WORKSHEET

CONTRACTOR: __________________________________________

Contract #: __________________________________________

Date of Request: ____________________

1 Purpose of Travel

2 In-Country POC

3 Personnel Traveling

4 Location(s)

5 Length of Trip

6 Validation that all travel

Prerequisites have been met?

7 Departure Airport

8 Arrival Airport

9 In Travel Dates

10 Country Clearance Lead

Time Met?

11 CLIN/SLIN/ACRN

Cost Estimate Total

ESTIMATED

COSTS

ACTUAL COSTS

Airfare

Excess Baggage

Travel Fees

Hotel

Hotel Taxes

(CONUS)

Per Diem

Rental Car or Taxi

Fuel

Parking

POV Mileage

MISC (VISA,

Foreign Tran Fee, ETC…)

TOTAL

Locality

Seasons

(Begin -End) Maximum

Lodging Local

Meals Local

Incidental s

Maximum

Per Diem Effective

Date

Example 01/01-12-31 213 74 19 306 04/01/2009