ATTACH 1 SOO_834_Network Defense Range Event.docx

Statement of Objective (SOO) 11 Jun 2020

1. SOO Title 834 Cyberspace Operations Squadron – Recon Network Defense Range Training Event

2. Purpose The 834 COS Training Flight (DOT) has the responsibility to ensure that Cyber Protection Team (CPT) operators are appropriately trained to perform their mission. New USCYBERCOM Job Qualification Requirements have been identified in the areas of Windows and Linux OS forensics, network traffic analysis, memory forensics, and others. In order to address these requirements for current operators while new training is in development, and to enhance operator performance through rigorous and realistic instruction, 834 COS DOT is pursuing on-site training by industry experts as a supplement to current unit programs.

2.1 Period of Performance (PoP): Performance period for this effort will commence on the effective date of the award, to include a one-year base period and two (2) one-year options.

3. Specific Requirements

3.1 Course Requirements

3.1.1 Provide a multi-day training event focused on intelligence-driven cyber threat hunt, incorporating genuine tactics and techniques employed by Advanced Persistent Threats.

3.1.2 Training should consist of several hands-on intrusion analysis scenarios, paired with instructional sessions by experienced Digital Forensics and Incident Response practitioners.

3.1.3 Scenarios will include, at a minimum: spearphishing with malware delivery, post-compromise enumeration, brute-force attack against an application, data exfiltration, ransomware attack, ransomware encryption key recovery, threat intelligence integration, browser-based exploitation, covert channels, credential theft, malicious use of local binaries, manipulation of sensitive information.

3.1.4 A detailed course syllabus shall be provided to the 38 CONS and 834 COS/DOT for the Network Defense Range Event to be updated after any major changes to the course.

3.1.5 The Network Defense Range course provided by the contractor shall cover at least 80% of the Joint Qualification Records (JQR) for Network Analyst – Senior; Systems Analyst – Linux – Senior; and Systems Analyst – Windows – Senior (Attachment 1). The syllabus and associated learning objectives with the course must be provided to 834 COS/DOT prior to acceptance.

3.1.6 A means of access to the curricula on the contractor’s infrastructure from Joint Base San Antonio (JBSA), Texas shall be provided. Each course shall accommodate up to forty (40) students.

3.1.7 The training shall include at a minimum: equipment, course materials (books, hardware, software, instructors, simulator access, and networked infrastructure) required to deliver the Network Defense Range course associated with this contract.

3.2 Student Accountability

3.2.1 The 834 COS/DOT shall provide a roster of Government students attending the Network Defense Range course to the contractor.

3.2.2 Government students are expected to attend the entire course. The 834 COS/DOT shall coordinate the Government student roster with the contractor not less than seven (7) days prior to the start of a class.

3.2.3 Failure of a student to attend or participate in training shall be reported to 834 COS/DOT.

3.2.4 In cases where the student is failing to progress, the contractor shall contact the 834 COS/DOT as needed following a failed evaluation.

3.2.5 In cases of student behavioral problems the contractor shall contact the 834 COS/DOT within 24 hours of incident(s), the 834 COS/DOT will contact the Government supervisor for action

3.2.6 In cases of illness or accident, the 38 CONS, the 834 COS/DOT and the Contractor will discuss the circumstances of the incident and decide to excuse a short absence and continue the course or withdraw the student from training. The decision will be made based on nature of incident, length of expected absence, student progression in the course, and student ability to complete the course.

3.3 Student Evaluation

The contractor shall provide the 834 COS/DOT with Government student module grade report at the end of each module, not later than 5 days after module completion. At a minimum the Government student module grade report shall contain the name of the Government students, detailed scoring for assignments, quizzes and/or tests from the module and a percentage based overall score for the module. The contractor shall provide the 834 COS/DOT with Government student graduation report at the end of class with Government students, not later than 10 days after graduation. At a minimum the Government student graduation report shall contain the name of the Government students and a final percentage based score. The contractor may report subject areas where a student has excelled or has demonstrated areas of significant concern.

3.4 Schedule and Enrollment

3.4.1 The contractor shall provide a course schedule to the 38 CONS and the 834 COS, not less than 14 days before the course start date.

3.4.2 The Government will coordinate with the contractor’s course registrar to enroll Government students in the Network Defense Range course. The time-frame for enrolling Government students shall conform with the contractor’s enrollment policies to the greatest extent possible; but not less than one (1) day notice to the contractor. If the requested course is not available, the contractor will recommend a future date for consideration.

3.4.3 The Contractor shall notify the 834 COS/DOT of the course start date, time, and location at least seven (7) days prior to course start date; or as soon as practical when the Government fails to enroll a student within seven (7) days of the course start date.

3.4.4 The contractor shall establish normal course attendance hours (start and ending times). The contractor shall make the course start hours and location of the course known to student at least seven (7) business days before the start of the class.

3.4.5 The Government may request the contractor conduct an out-of-cycle course.

4 General Requirements

4.1 Location and Hours of Work

4.1.1 Delivery of the course referenced herein requires work at JBSA.

4.1.2 Normal Government workdays are Monday through Friday except US Federal Holidays. Contractor employees typically work eight (8) hours per day, 40 hours per week. Recognized holiday: The contractor is not required to provide service on the following days: New Year’s Day, Martin Luther King Day, Presidents Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day and Christmas Day. If the holiday falls on Saturday, it is observed on Friday. If the holiday falls on a Sunday, it is observed on Monday.

4.1.3 All Government employees are expected to be available during course hours. Any issues related to weather or security delays / closures will be coordinated (in-person, by phone, or by email) directly with 38 CONS, 834 COS/DOT, and the contractor in order to establish an approved course of action that ensures the delivery and continuity of instruction, installation, and/or maintenance actions.

4.2 The contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel

4.3 The contractor shall employ and utilize qualified personnel with appropriate combinations of education, training, and experience in order to deliver the best product to the Government. The contractor shall submit instructor qualifications to the contracting officer; in writing or by email at least one week prior to the commencement of each class.

4.4 Continuation of Essential Department of Defense (DoD) Contractor Services during Crisis: This requirement has been determined not to be essential and does not require continued support during a crisis as defined in DFARS 252.237-7023

4.5 The contractor shall comply with all applicable Federal and State environmental requirements. Additionally, the contractor shall reduce the environmental damages associated with this procurement by considering the specification of environmentally preferable products and services to the extent feasible consistent with price, performance, availability, and safety considerations. All products should be considered that have recycled or bio-based content as well as other environmentally preferable attributes, such as: Reduced packaging, Durability and reparability, Reduced toxicity, Water conservation, Low volatile organic compound content, Asbestos alternative.

Attachments:

1. Joint Qualification Record (JQR)_Coverage